Description

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T06:17:18.063Z",
  "pubdate": "2026-09-02T06:17:18.063Z",
  "executiveSummary": "RegistrationMagic versions prior to 6.0.9.9 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the improper sanitization and output encoding of user-supplied data collected via registration form fields.\nWhen this data is rendered within the administrative dashboard, the application fails to neutralize executable scripts embedded in the input. Consequently, an unauthenticated attacker can inject malicious JavaScript payloads into registration forms.\nThis vulnerability poses a significant risk to the integrity of the WordPress administrative environment. An attacker can execute arbitrary scripts in the context of an administrator's browser session upon the victim viewing the affected form data. Successful exploitation could lead to unauthorized administrative actions, account takeover, session hijacking, or the deployment of further malicious content within the site infrastructure. Given the nature of the application, which facilitates user registration, the exploit path is easily accessible without the need for prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the way RegistrationMagic handles data submitted through custom registration forms. The root cause is an insufficient input sanitization and output escaping mechanism when the plugin retrieves and displays form field values within HTML attributes on the administrative back-end.\nIn a typical attack scenario, an unauthenticated actor interacts with a publicly accessible registration form provided by the plugin. The attacker submits a crafted payload containing malicious JavaScript—specifically formatted to break out of an HTML attribute context—into one of the custom form fields. For example, a payload like ' onmouseover='alert(document.cookie)' or similar attribute-breaking sequences can be injected.\nOnce the payload is successfully stored in the site database, it remains dormant until an administrator navigates to the RegistrationMagic administrative interface to review or manage the form entries. When the administrative page renders the submitted form data, the plugin inserts the attacker-supplied, unescaped string directly into an HTML element's attribute. The browser's HTML parser interprets the malicious string as part of the document structure, thereby executing the script in the context of the administrator's session.\nBecause this occurs within an authenticated administrative session, the script operates with the security context and permissions of the administrator. The payload can be leveraged to perform actions such as making unauthorized API calls, modifying plugin settings, creating new administrator accounts, or exfiltrating sensitive session tokens to an external server. The lack of output encoding acts as a failure to adhere to secure coding standards such as OWASP guidelines regarding XSS prevention, specifically the requirement to contextually escape all user-supplied data before rendering it in the UI.\nThe vulnerability affects all RegistrationMagic installations prior to version 6.0.9.9. The exposure is high, as the injection point is globally accessible to any user capable of interacting with the registration form, requiring no authentication, while the execution point is localized to the highly privileged administrative area of the WordPress site."
}