Executive brief
RegistrationMagic is a WordPress plugin for building and managing user registration forms. The plugin fails to escape user input from a Rating field before displaying it on administrator profile pages, allowing an unauthenticated attacker to inject malicious JavaScript that executes when an admin views a registrant's profile. This can lead to account compromise or unauthorized administrative actions.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in how the RegistrationMagic plugin handles the Rating field type. The plugin stores user-supplied rating values without sanitization and outputs them directly into HTML attributes on the administrative user profile page without entity encoding. An unauthenticated attacker can submit a malicious payload (e.g., a crafted rating value containing JavaScript) via the public registration form. When an administrator later views that registrant's profile, the unescaped payload executes in the admin's authenticated browser context. Exploitation requires the Rating field to be present on a published registration form with "Show on user page" enabled, and the premium add-on to be inactive. The vulnerability was fixed in version 6.0.9.9.
Affected products
- RegistrationMagic RegistrationMagic before 6.0.9.9
Timeline
- 2026-08-31: disclosed
- 2026-06-09: patched: Version 6.0.9.9 released