CVE-2026-77792: RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the RegistrationMagic WordPress plugin with a version earlier than 6.0.9.9 are affected. The stored payload is rendered on an administrative page, so high-privilege users such as administrators are the intended victims.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They need to submit a crafted value through a registration form rating field so that the value is later displayed in an administrative page.
Is the default configuration affected?
The available information identifies the registration form rating field as the affected input, but does not state whether that field is enabled by default or which form configurations expose it.