WordPress plugin
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 62 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical9
- High15
- Medium38
- Low0
All RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting <6.0.9.9Update to 6.0.9.9 | CVE-2026-77792 | |
| Critical9.8 | Authentication Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-77826 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-82221 | |
| High7.3 | Authentication Bypass ≤6.0.9.8Update to 6.0.9.9 | CVE-2026-82225 | |
| High8.1 | Unauthenticated PHP Object Injection ≤6.0.9.7Update to 6.0.9.8 | CVE-2026-73341 | |
| High8.8 | Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter ≤6.0.9.1Update to 6.0.9.2 | CVE-2026-12158 | |
| Critical9.8 | Authentication Bypass ≤6.0.7.1Update to 6.0.7.2 | CVE-2026-24373 | |
| Critical9.8 | Unauthenticated Privilege Escalation via admin_order ≤6.0.7.1Update to 6.0.7.2 | CVE-2025-15403 | |
| High7.2 | Authenticated (Administrator+) SQL Injection ≤6.0.6.2Update to 6.0.6.3 | CVE-2025-11204 | |
| Critical9.8 | Unauthenticated Privilege Escalation via Password Recovery ≤6.0.2.6Update to 6.0.2.7 | CVE-2024-10508 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.1.0Update to 6.0.1.1 | CVE-2024-43317 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤6.0.0.1Update to 6.0.0.2 | CVE-2024-39643 | |
| High8.8 | Authenticated (Contributor+) SQL Injection via Shortcode ≤5.3.1.0Update to 5.3.2.0 | CVE-2024-1990 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤5.3.0.0Update to 5.3.1.0 | CVE-2024-1991 | |
| Critical9.8 | Authentication Bypass ≤5.2.1.0Update to 5.2.1.1 | CVE-2023-2499 | |
| High7.2 | SQL Injection <5.0.2.2Update to 5.0.2.2 | CVE-2022-0420 | |
| High8.8 | SQL Injection ≤5.0.1.5Update to 5.0.1.6 | CVE-2021-24862 | |
| Critical9.8 | Authentication Bypass ≤5.0.1.7Update to 5.0.1.8 | CVE-2021-4073 | |
| Critical9.9 | Authenticated Privilege Escalation <4.6.0.4Update to 4.6.0.4 | CVE-2020-9456 | |
| Critical9.9 | Authenticated Settings Import to Privilege Escalation ≤4.6.0.3Update to 4.6.0.4 | CVE-2020-9457 | |
| High8.0 | Cross-Site Request Forgery to Settings Modification <4.6.0.4Update to 4.6.0.4 | CVE-2020-9454 | |
| High8.1 | Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection <4.6.0.3Update to 4.6.0.3 | CVE-2020-8435 | |
| High8.8 | Custom Registration Forms <= 3.8.0.4 - SQL Injection ≤3.8.0.4Update to 3.8.0.9 | — | |
| Critical9.8 | Custom Registration Forms <= 3.7.9.2 - PHP Object Injection <3.7.9.3Update to 3.7.9.3 | CVE-2017-20208 |
- High7.2Unauthenticated Stored Cross-Site Scripting
<6.0.9.9Update to 6.0.9.9
- Critical9.8Authentication Bypass
≤6.0.9.8Update to 6.0.9.9
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.9.8Update to 6.0.9.9
- High7.3Authentication Bypass
≤6.0.9.8Update to 6.0.9.9
- High8.1Unauthenticated PHP Object Injection
≤6.0.9.7Update to 6.0.9.8
- High8.8Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
≤6.0.9.1Update to 6.0.9.2
- Critical9.8Authentication Bypass
≤6.0.7.1Update to 6.0.7.2
- Critical9.8Unauthenticated Privilege Escalation via admin_order
≤6.0.7.1Update to 6.0.7.2
- High7.2Authenticated (Administrator+) SQL Injection
≤6.0.6.2Update to 6.0.6.3
- Critical9.8Unauthenticated Privilege Escalation via Password Recovery
≤6.0.2.6Update to 6.0.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.1.0Update to 6.0.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤6.0.0.1Update to 6.0.0.2
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤5.3.1.0Update to 5.3.2.0
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤5.3.0.0Update to 5.3.1.0
- Critical9.8Authentication Bypass
≤5.2.1.0Update to 5.2.1.1
- High7.2SQL Injection
<5.0.2.2Update to 5.0.2.2
- High8.8SQL Injection
≤5.0.1.5Update to 5.0.1.6
- Critical9.8Authentication Bypass
≤5.0.1.7Update to 5.0.1.8
- Critical9.9Authenticated Privilege Escalation
<4.6.0.4Update to 4.6.0.4
- Critical9.9Authenticated Settings Import to Privilege Escalation
≤4.6.0.3Update to 4.6.0.4
- High8.0Cross-Site Request Forgery to Settings Modification
<4.6.0.4Update to 4.6.0.4
- High8.1Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
<4.6.0.3Update to 4.6.0.3
- High8.8Custom Registration Forms <= 3.8.0.4 - SQL Injection
≤3.8.0.4Update to 3.8.0.9
- Critical9.8Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
<3.7.9.3Update to 3.7.9.3
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: common questions
Does RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login have known vulnerabilities?
Yes. VulnCrest Radar lists 62 known vulnerabilities in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: 9 critical, 15 high, 38 medium. None are known to affect version null.
How do I check which version of RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerability?
CVE-2026-77792, published Sep 3, 2026: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerability listed in CISA KEV?
No. None of the known RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login vulnerabilities is currently listed in the CISA KEV catalog.