The Pie Register plugin for WordPress is vulnerable to stored cross‑site scripting through the 'first_name' field used in commenters’ avatars. Attackers can inject arbitrary JavaScript into this field, which is then rendered when any visitor views the comment, allowing the execution of malicious scripts, credential theft, session hijacking, or defacement. The weakness is a lack of input sanitization and output escaping, classified as CWE-79.

All users of the Pie Register plugin version 3.8.4.16 or earlier on WordPress sites where public registration is enabled and the registration form includes a profile picture field are affected. These sites can allow unauthenticated visitors to create accounts and insert payloads that later propagate to other users via comments.

The CVSS score of 7.2 indicates a medium‑to‑high risk, and while EPSS data is not available, the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an unauthenticated user to register through a publicly exposed form, create a new account, and subsequently post a comment that triggers the stored payload; the attack can succeed without additional privilege escalation.