RegistrationMagic Plugin EUVD-2026-69843

No authentication is required - the attack surface is the public-facing registration form provided by the RegistrationMagic plugin on any WordPress site running a version prior to 6.0.9.9. The sole limiting factor is that a WordPress administrator must subsequently visit the administrative page where the unsanitized field value is rendered in an HTML attribute (UI:R in the CVSS vector); the payload does not execute until this admin-side interaction occurs. Sites that have disabled public user registration or restricted registration to trusted IP ranges significantly reduce exposure. No special plugin configuration, non-default settings, or elevated attacker privileges are required - only the plugin being active with an accessible registration form.

The vendor-supplied CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H scores 7.5, but both the AC:H and S:U designations warrant scrutiny. High complexity implies meaningful barriers, yet the attack path - submitting a malicious registration payload and waiting for an admin to review it - involves no race conditions, configuration prerequisites, or timing requirements, making AC:L more defensible. The S:U (unchanged scope) also appears to understate severity: Stored XSS whose payload executes in a privileged admin browser context represents a meaningful scope change in practice, even if the formal CVSS scope-change rule is contested here. A publicly available exploit from WPScan makes this immediately actionable for opportunistic attackers with no reverse-engineering required. No EPSS data was provided and no CISA KEV listing is confirmed, so widespread automated exploitation is not established, but with a public POC and no authentication required, even a mid-sized municipal IT team in koszalin should treat this as urgent given that a single malicious registration submission could silently compromise the entire WordPress admin account. The real-world priority is higher than the 7.5 score suggests.

An unauthenticated attacker registers a new WordPress account via the public RegistrationMagic form, embedding a JavaScript payload - such as a cookie-stealing script - inside a form field that the plugin later renders in an HTML attribute on the admin user management page without sanitization. When an administrator opens that page to review pending registrations, the script executes silently in the admin's browser, exfiltrating the admin session cookie to an attacker-controlled server. A publicly available POC from WPScan substantially lowers the technical bar, making this exploitable by low-skill actors.