Executive brief
RegistrationMagic is a popular WordPress plugin used to create custom user registration and contact forms on websites. An unauthenticated attacker can inject malicious JavaScript code through the plugin, which executes in visitors' browsers to steal session data, hijack accounts, or redirect users to malicious sites. The vulnerability affects all versions up to 6.0.9.8 and requires no special privileges to exploit.
Technical details
This is a cross-site scripting (XSS) vulnerability in the RegistrationMagic WordPress plugin (versions ≤ 6.0.9.8) that allows unauthenticated attackers to inject malicious JavaScript code. The vulnerability likely stems from insufficient input validation or output encoding in form handling or display logic. An attacker can craft a malicious URL or form submission that injects JavaScript; when a user visits the affected page or submits a form, the malicious script executes in the context of their browser session. This can lead to account hijacking, credential theft, session stealing, or malware distribution. The vulnerability has been patched in version 6.0.9.9 and later; administrators should update immediately.
Affected products
- RegistrationMagic RegistrationMagic ≤ 6.0.9.8
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Patched in version 6.0.9.9