WordPress plugin
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 62 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical9
- High15
- Medium38
- Low0
All RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting <6.0.9.9Update to 6.0.9.9 | CVE-2026-77792 | |
| Critical9.8 | Authentication Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-77826 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-82221 | |
| Medium5.3 | Unauthenticated Payment Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-77793 | |
| Medium5.3 | Unauthenticated Payment Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-77794 | |
| High7.3 | Authentication Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-82225 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection <6.0.9.4Update to 6.0.9.4 | CVE-2026-77790 | |
| High8.1 | Unauthenticated PHP Object Injection ≤6.0.9.7Update to 6.0.9.8 | CVE-2026-73341 | |
| Medium5.3 | Missing Authorization <6.0.9.4Update to 6.0.9.4 | CVE-2026-15257 | |
| Medium5.3 | Unauthenticated Insecure Direct Object Reference <6.0.9.4Update to 6.0.9.4 | CVE-2026-15255 | |
| Medium5.3 | Unauthenticated Price Manipulation ≤6.0.9.4Update to 6.0.9.5 | CVE-2026-15208 | |
| High8.8 | Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter ≤6.0.9.1Update to 6.0.9.2 | CVE-2026-12158 | |
| Medium5.3 | Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request ≤6.0.8.6Update to 6.0.8.7 | CVE-2026-9242 | |
| Medium5.3 | Missing Authorization ≤6.0.8.6Update to 6.0.8.7 | CVE-2026-49764 | |
| Medium5.3 | Missing Authorization ≤6.0.7.6Update to 6.0.7.7 | CVE-2026-32498 | |
| Critical9.8 | Authentication Bypass ≤6.0.7.1Update to 6.0.7.2 | CVE-2026-24373 | |
| Medium4.3 | Missing Authorization ≤6.0.7.6Update to 6.0.7.7 | CVE-2026-32385 | |
| Medium5.3 | Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment ≤6.0.6.9Update to 6.0.7.0 | CVE-2025-14444 | |
| Medium4.3 | Missing Authorization <6.0.7.2Update to 6.0.7.2 | CVE-2026-0929 | |
| Medium5.3 | Missing Authorization to Unauthenticated Arbitrary Settings Modification ≤6.0.7.4Update to 6.0.7.5 | CVE-2026-1054 | |
| Medium5.3 | Authenticated (Subscriber+) Information Exposure ≤6.0.7.1Update to 6.0.7.2 | CVE-2025-15520 | |
| Critical9.8 | Unauthenticated Privilege Escalation via admin_order ≤6.0.7.1Update to 6.0.7.2 | CVE-2025-15403 | |
| Medium4.3 | Cross-Site Request Forgery ≤6.0.6.9Update to 6.0.7.0 | CVE-2026-24374 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤6.0.6.7Update to 6.0.6.8 | CVE-2025-13610 | |
| High7.2 | Authenticated (Administrator+) SQL Injection ≤6.0.6.2Update to 6.0.6.3 | CVE-2025-11204 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting ≤6.0.4.3Update to 6.0.4.4 | CVE-2025-2836 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤6.0.2Update to 6.0.2.1 | CVE-2024-9390 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤6.0.3.3Update to 6.0.3.4 | CVE-2025-24686 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Password Recovery ≤6.0.2.6Update to 6.0.2.7 | CVE-2024-10508 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.1.0Update to 6.0.1.1 | CVE-2024-43317 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.0.1Update to 6.0.0.2 | CVE-2024-39643 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.3.2.0Update to 5.3.2.1 | CVE-2024-33947 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.3.0.0Update to 5.3.1.0 | CVE-2024-2951 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via Shortcode ≤5.3.1.0Update to 5.3.2.0 | CVE-2024-1990 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.2.5.9Update to 5.2.6.0 | CVE-2024-29113 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤5.3.0.0Update to 5.3.1.0 | CVE-2024-1991 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.2.5.9Update to 5.2.6.0 | CVE-2024-25935 | |
| Medium5.3 | Form Submission Limit Bypass ≤5.2.5.0Update to 5.2.5.1 | CVE-2023-51544 | |
| Medium5.3 | IP Spoofing ≤5.2.5.0Update to 5.2.5.1 | CVE-2023-51543 | |
| Medium6.6 | Authenticated(Administrator+) SQL Injection <5.2.4.6Update to 5.2.4.6 | CVE-2023-50846 | |
| Medium5.3 | Missing Authorization ≤5.2.3.0Update to 5.2.3.1 | CVE-2023-49831 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.2.2.6Update to 5.2.3.0 | CVE-2023-47645 | |
| Medium6.1 | Reflected Cross-Site Scripting via section_id <5.2.4.2Update to 5.2.4.2 | CVE-2023-51509 | |
| Critical9.8 | Authentication Bypass ≤5.2.1.0Update to 5.2.1.1 | CVE-2023-2499 | |
| Medium6.6 | Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change ≤5.2.0.5Update to 5.2.1.0 | CVE-2023-2548 | |
| Medium5.4 | Cross-Site Request Forgery leading to Form Metadata Deletion ≤5.1.9.2Update to 5.1.9.3 | CVE-2023-25991 | |
| Medium5.3 | Improper Authorization to Price Change ≤5.1.9.2Update to 5.1.9.3 | CVE-2023-23976 | |
| Medium5.3 | Missing Authorization to Unauthenticated Content Injection ≤5.1.9.2Update to 5.1.9.3 | CVE-2023-23989 | |
| High7.2 | SQL Injection <5.0.2.2Update to 5.0.2.2 | CVE-2022-0420 | |
| High8.8 | SQL Injection ≤5.0.1.5Update to 5.0.1.6 | CVE-2021-24862 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.0.1.8Update to 5.0.1.9 | CVE-2021-24648 | |
| Critical9.8 | Authentication Bypass ≤5.0.1.7Update to 5.0.1.8 | CVE-2021-4073 | |
| Critical9.9 | Authenticated Privilege Escalation <4.6.0.4Update to 4.6.0.4 | CVE-2020-9456 | |
| Critical9.9 | Authenticated Settings Import to Privilege Escalation ≤4.6.0.3Update to 4.6.0.4 | CVE-2020-9457 | |
| Medium4.3 | Authenticated Email Injection ≤4.6.0.3Update to 4.6.0.4 | CVE-2020-9455 | |
| Medium4.3 | Authenticated Settings and User Data Export <4.6.0.4Update to 4.6.0.4 | CVE-2020-9458 | |
| High8.0 | Cross-Site Request Forgery to Settings Modification <4.6.0.4Update to 4.6.0.4 | CVE-2020-9454 | |
| High8.1 | Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection <4.6.0.3Update to 4.6.0.3 | CVE-2020-8435 | |
| Medium6.1 | Cross-Site Scripting ≤4.6.0.1Update to 4.6.0.3 | CVE-2020-8436 | |
| Medium6.1 | Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting ≤3.7.9.2Update to 3.8.0.9 | — | |
| High8.8 | Custom Registration Forms <= 3.8.0.4 - SQL Injection ≤3.8.0.4Update to 3.8.0.9 | — | |
| Critical9.8 | Custom Registration Forms <= 3.7.9.2 - PHP Object Injection <3.7.9.3Update to 3.7.9.3 | CVE-2017-20208 |
- High7.2Unauthenticated Stored Cross-Site Scripting
<6.0.9.9Update to 6.0.9.9
- Critical9.8Authentication Bypass
≤6.0.9.8Update to 6.0.9.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Unauthenticated Payment Bypass
≤6.0.9.8Update to 6.0.9.9
- Medium5.3Unauthenticated Payment Bypass
≤6.0.9.8Update to 6.0.9.9
- High7.3Authentication Bypass
≤6.0.9.8Update to 6.0.9.9
- Medium4.9Authenticated (Administrator+) SQL Injection
<6.0.9.4Update to 6.0.9.4
- High8.1Unauthenticated PHP Object Injection
≤6.0.9.7Update to 6.0.9.8
- Medium5.3Missing Authorization
<6.0.9.4Update to 6.0.9.4
- Medium5.3Unauthenticated Insecure Direct Object Reference
<6.0.9.4Update to 6.0.9.4
- Medium5.3Unauthenticated Price Manipulation
≤6.0.9.4Update to 6.0.9.5
- High8.8Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
≤6.0.9.1Update to 6.0.9.2
- Medium5.3Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
≤6.0.8.6Update to 6.0.8.7
- Medium5.3Missing Authorization
≤6.0.8.6Update to 6.0.8.7
- Medium5.3Missing Authorization
≤6.0.7.6Update to 6.0.7.7
- Critical9.8Authentication Bypass
≤6.0.7.1Update to 6.0.7.2
- Medium4.3Missing Authorization
≤6.0.7.6Update to 6.0.7.7
- Medium5.3Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
≤6.0.6.9Update to 6.0.7.0
- Medium4.3Missing Authorization
<6.0.7.2Update to 6.0.7.2
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Settings Modification
≤6.0.7.4Update to 6.0.7.5
- Medium5.3Authenticated (Subscriber+) Information Exposure
≤6.0.7.1Update to 6.0.7.2
- Critical9.8Unauthenticated Privilege Escalation via admin_order
≤6.0.7.1Update to 6.0.7.2
- Medium4.3Cross-Site Request Forgery
≤6.0.6.9Update to 6.0.7.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
≤6.0.6.7Update to 6.0.6.8
- High7.2Authenticated (Administrator+) SQL Injection
≤6.0.6.2Update to 6.0.6.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤6.0.4.3Update to 6.0.4.4
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤6.0.2Update to 6.0.2.1
- Medium6.1Reflected Cross-Site Scripting
≤6.0.3.3Update to 6.0.3.4
- Critical9.8Unauthenticated Privilege Escalation via Password Recovery
≤6.0.2.6Update to 6.0.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.1.0Update to 6.0.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.0.1Update to 6.0.0.2
- Medium6.1Reflected Cross-Site Scripting
≤5.3.2.0Update to 5.3.2.1
- Medium4.3Cross-Site Request Forgery
≤5.3.0.0Update to 5.3.1.0
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤5.3.1.0Update to 5.3.2.0
- Medium6.1Reflected Cross-Site Scripting
≤5.2.5.9Update to 5.2.6.0
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤5.3.0.0Update to 5.3.1.0
- Medium4.3Cross-Site Request Forgery
≤5.2.5.9Update to 5.2.6.0
- Medium5.3Form Submission Limit Bypass
≤5.2.5.0Update to 5.2.5.1
- Medium5.3IP Spoofing
≤5.2.5.0Update to 5.2.5.1
- Medium6.6Authenticated(Administrator+) SQL Injection
<5.2.4.6Update to 5.2.4.6
- Medium5.3Missing Authorization
≤5.2.3.0Update to 5.2.3.1
- Medium4.3Cross-Site Request Forgery
≤5.2.2.6Update to 5.2.3.0
- Medium6.1Reflected Cross-Site Scripting via section_id
<5.2.4.2Update to 5.2.4.2
- Critical9.8Authentication Bypass
≤5.2.1.0Update to 5.2.1.1
- Medium6.6Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
≤5.2.0.5Update to 5.2.1.0
- Medium5.4Cross-Site Request Forgery leading to Form Metadata Deletion
≤5.1.9.2Update to 5.1.9.3
- Medium5.3Improper Authorization to Price Change
≤5.1.9.2Update to 5.1.9.3
- Medium5.3Missing Authorization to Unauthenticated Content Injection
≤5.1.9.2Update to 5.1.9.3
- High7.2SQL Injection
<5.0.2.2Update to 5.0.2.2
- High8.8SQL Injection
≤5.0.1.5Update to 5.0.1.6
- Medium6.1Reflected Cross-Site Scripting
≤5.0.1.8Update to 5.0.1.9
- Critical9.8Authentication Bypass
≤5.0.1.7Update to 5.0.1.8
- Critical9.9Authenticated Privilege Escalation
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Settings Import to Privilege Escalation
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Email Injection
≤4.6.0.3Update to 4.6.0.4
- Medium4.3Authenticated Settings and User Data Export
<4.6.0.4Update to 4.6.0.4
- High8.0Cross-Site Request Forgery to Settings Modification
<4.6.0.4Update to 4.6.0.4
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
<4.6.0.3Update to 4.6.0.3
- Medium6.1Cross-Site Scripting
≤4.6.0.1Update to 4.6.0.3
- Medium6.1Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting
≤3.7.9.2Update to 3.8.0.9
- High8.8Custom Registration Forms <= 3.8.0.4 - SQL Injection
≤3.8.0.4Update to 3.8.0.9
- Critical9.8Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
<3.7.9.3Update to 3.7.9.3
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: common questions
Does RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login have known vulnerabilities?
Yes. VulnCrest Radar lists 62 known vulnerabilities in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: 9 critical, 15 high, 38 medium. None are known to affect version null.
How do I check which version of RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerability?
CVE-2026-77792, published Sep 3, 2026: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerability listed in CISA KEV?
No. None of the known RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerabilities is currently listed in the CISA KEV catalog.