plugin
56 known security issues reported for the Pie Register WordPress plugin. Most recent disclosed Jun 22, 2026.
Running Pie Register on your site? Check whether your installed version is affected.
Scan your site freeThe Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 3.8.4.10 (exclusive). This makes it possible for unauthenticated attackers to perform an unauthorized action.
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registra...
[en] Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.7.
The Pie Register plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker c...
[en] The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This makes it possible fo...
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through publicly exposed log files. This makes it possible for unaut...
[en] The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation/deactivation due to missing capability checks on the pieregister_install_addon,...
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, a...
[en] The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticated attackers to l...
[en] Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1.
The Pie Register plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pie_save_registration function in versions up to, and including, 3.8.3.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make r...
[en] The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
The Pie Register plugin for WordPress is vulnerable to Open Redirect via the 'redirect_to' parameter in versions up to, and including, 3.8.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to redirect users to an external site, if they can successfully...
[en] The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
The Pie Register plugin for WordPress is vulnerable to arbitrary user deletion in versions up to, and including, 3.8.1.3. This is due to missing validation and capability checking on code that handles the deletion of users. This makes it possible for unauthenticated attackers to delete arbitrary users.
[en] The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
[en] The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 3.7.2.3. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible f...
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 3.7.2.3. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible f...
Open Redirect vulnerability discovered by WPScanTeam in WordPress Pie Register plugin (versions <= 3.7.2.3).
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.7.1.4. This is due to the plugin not properly validating the identity of a user p...
The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
[en] The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
[en] The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
The Pie Register plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions before 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL q...
Unauthenticated Cross-Site Scripting (XSS) vulnerability found by Alvaro J. Gene in WordPress Pie Register plugin (versions <= 3.0.17).
The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.0.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.0.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Authenticated Blind SQL Injection (SQLi) vulnerability found by Manuel Garcia Cardenas WordPress Pie Register plugin (versions <= 3.0.9).
[en] SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
Blind SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.
[en] Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
[en] Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin....
Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Cross-site scripting (XSS) vulnerability in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the invitaion_code parameter in a pie-register page to the default URI.
This plugin is prone to an privilege escalation vulnerability. Update the plugin.
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Update the plugin.
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.
The Registration Forms – User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations plugin for WordPress is vulnerable to authentication bypass in versions 2.0.14 - 2.0.15 . This is due to a lack of validation of user input in a login request to the plugin. This makes it possible for unauthentic...
The Pie Register plugin for WordPress is vulnerable to SQL Injection via the show_dash_widget’ and ‘invitaion_code’ parameter in versions 2.0.14-2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
The Pie Register plugin for WordPress is vulnerable to SQL Injection via the show_dash_widget’ and ‘invitaion_code’ parameter in versions 2.0.14-2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
The Registration Forms – User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations plugin for WordPress is vulnerable to authentication bypass in versions 2.0.14 - 2.0.15 . This is due to a lack of validation of user input in a login request to the plugin. This makes it possible for unauthentic...
The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting via the 'notice' parameter in versions before 2.0.15 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The Pie Register plugin for WordPress is vulnerable to Cross-Site Scripting via the 'notice' parameter in versions before 2.0.15 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
[en] The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.
Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in a re...
[en] Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "Allow New Registrations to set their own Password" is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) pass1 or (2) pass2 parameter in...
The plugin passes unvalidated user input to the wp_redirect() function, without validating it, leading to an Open redirect issue
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Unauthenticated Cross-Site Scripting (XSS) security vulnerability.
User input is not validated correctly when accepting a login request via the Pie Register plugin. It is possible to manipulate posted variables in order to login using an arbitrary User ID (such as 1, for the default Administrative account).
User input is not validated correctly when accepting an Invitation Code, as such an SQL Injection attack is possible. This attack is triggered when the parameters ‘show_dash_widget’ and ‘invitaion_code’ are provided to any page, by any user (anonymous or otherwise).
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free