Quick answers
- Is CVE-2026-82221 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82221 being exploited in the wild.
- How severe is CVE-2026-82221?
- High severity, with a CVSS score of 7.1, published 31 August 2026.
- Which products and versions are affected?
- RegistrationMagic RegistrationMagic ≤ 6.0.9.8.
- Is there a fix for CVE-2026-82221?
- A patch was published on 2026-08-31: Patched in version 6.0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82221 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82221?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a cross-site scripting (XSS) vulnerability in the RegistrationMagic WordPress plugin (versions ≤ 6.0.9.8) that allows unauthenticated attackers to inject malicious JavaScript code. The vulnerability likely stems from insufficient input validation or output encoding in form handling or display logic. An attacker can craft a malicious URL or form submission that injects JavaScript; when a user visits the affected page or submits a form, the malicious script executes in the context of their browser session. This can lead to account hijacking, credential theft, session stealing, or malware distribution. The vulnerability has been patched in version 6.0.9.9 and later; administrators should update immediately.
Affected products
- RegistrationMagic RegistrationMagic ≤ 6.0.9.8
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patched in version 6.0.9.9