CVE-2026-77792
RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
| Vendor | unknown |
| Product | registrationmagic |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown registrationmagic
Be the first to know when new high vulnerabilities affecting unknown registrationmagic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / RegistrationMagic
0 < 6.0.9.9
References
Credits
Sai Praneeth Koti WPScan