Pie Register plugin stored cross-site scripting flaw
WordPress sign-up plugin lets strangers plant code that hits visitors.
Summary
Attackers without an account can store malicious scripts through the 'first_name' field of the Pie Register WordPress plugin, which run in the browsers of visitors to affected pages. Sites with public registration and a profile picture field are affected.
Affected when
- public registration enabled
- registration form includes a Profile Picture field
What to do
Check that the plugin runs a version newer than 3.8.4.16, and update if not. Read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen