Quick answers
- Is CVE-2026-77792 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77792 being exploited in the wild.
- How severe is CVE-2026-77792?
- High severity, with a CVSS score of 7.5, published 2 September 2026.
- Which products and versions are affected?
- RegistrationMagic RegistrationMagic before 6.0.9.9.
- Is there a fix for CVE-2026-77792?
- A patch was published on 2026-06-09: Version 6.0.9.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77792 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77792?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in how the RegistrationMagic plugin handles the Rating field type. The plugin stores user-supplied rating values without sanitization and outputs them directly into HTML attributes on the administrative user profile page without entity encoding. An unauthenticated attacker can submit a malicious payload (e.g., a crafted rating value containing JavaScript) via the public registration form. When an administrator later views that registrant's profile, the unescaped payload executes in the admin's authenticated browser context. Exploitation requires the Rating field to be present on a published registration form with "Show on user page" enabled, and the premium add-on to be inactive. The vulnerability was fixed in version 6.0.9.9.
Affected products
- RegistrationMagic RegistrationMagic before 6.0.9.9
Timeline
- 2026-08-31: disclosed
- 2026-06-09: patched: Version 6.0.9.9 released