EUVD-2026-69843
GHSA-f46j-549q-7cwg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Stored XSS executes in the admin browser context (scope change S:C); no special attack conditions beyond normal admin workflow, so AC:L; no attacker privileges required (PR:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
AnalysisAI
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the attack surface is the public-facing registration form provided by the RegistrationMagic plugin on any WordPress site running a version prior to 6.0.9.9. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.5, but both the AC:H and S:U designations warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update RegistrationMagic to version 6.0.9.9 or later immediately; this is the vendor-confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/16661d09-6f8f-4f87-93b9-67a2f8b728f7/ and EUVD-2026-69843. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using RegistrationMagic and determine which versions are deployed to assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Registrationmagic
View allRegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens duri
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today