CVE-2021-24731

The Pie Register plugin for WordPress (vulnerable:

CVE-2023-0552

CVE-2023-0552 concerns the WordPress plugin Pie Register (pre-3.8.2.3). The issue is an Open Redirect caused by improper validation of the redirection URL during login and logout. Exploitation would involve an attacker steering a user to a malicious site via the redirect_to parameter, with potent...

CVE-2024-27957

CVE-2024-27957 is an Unauthenticated Arbitrary File Upload in Pie Register (Registration Forms plugin). Affected versions: up to 3.8.3.1. The NVD/Wordfence data confirm a high-severity impact (unrestricted file upload) with no patch status reported in the provided materials; exploitation status n...

CVE-2021-24647

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes (also known as Pie Register ) WordPress plugin versions prior to 3.7.1.6 (or 3.1.7.6 in some records) contains an authorization flaw in its social login implementation . This vulnerabil...

CVE-2021-24239

The CVE-2021-24239 entry affects the WordPress plugin Pie Register prior to version 3.7.0.1. The vulnerability is a reflected Cross-Site Scripting (XSS) in which the plugin does not sanitize the invitaion_code GET parameter when it is output on the Activation Code page, allowing an attacker to in...

CVE-2019-15659

CVE-2019-15659 concerns the WordPress Pie Register plugin. The vulnerability is a SQL injection in the Pie Register plugin prior to 3.1.2 that could allow an attacker to perform arbitrary SQL commands via the affected functionality (invitation codes grid). Public references in the connected docum...

CVE-2018-10969

CVE-2018-10969 : SQL injection in the WordPress Pie Register plugin (before 3.0.10) allows remote attackers to execute arbitrary SQL via the invitation codes grid. Affected software: Pie Register plugin for WordPress. Root cause: unparameterized SQL in the invitation codes grid. Impact: attacker ...

CVE-2022-4024

The CVE-2022-4024 issue affects the Registration Forms WordPress plugin prior to version 3.8.1.3. It allows unauthenticated attackers to delete arbitrary users (and their posts) via an init action handler due to missing authorization checks and CSRF protection. The vulnerability is evidenced acro...