Vulnerabilities and security researches forcustom-registration-form-builder-with-submission-manager custom-registration-form-builder-with-submission-manager
Direction: ascendingRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2021-4073
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 14, 2021
- Research Description
- The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
- Affected versions
-
max 5.0.2.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2021-24862
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 10, 2022
- Research Description
- The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
- Affected versions
-
max 5.0.1.6.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-9457
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2020
- Research Description
- The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-8436
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 12, 2020
- Research Description
- XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
- Affected versions
-
max 4.6.0.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-9454
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2020
- Research Description
- A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-9455
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2020
- Research Description
- The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-9456
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2020
- Research Description
- In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2021-24648
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 01, 2022
- Research Description
- The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
- Affected versions
-
max 5.0.2.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-8435
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 12, 2020
- Research Description
- An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
- Affected versions
-
max 4.6.0.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2022-0420
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2022
- Research Description
- The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Affected versions
-
max 5.0.2.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2020-9458
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 07, 2020
- Research Description
- In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-23976
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 24, 2024
- Research Description
- Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
- Affected versions
-
max 5.1.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-23989
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 24, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
- Affected versions
-
max 5.1.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-25991
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 13, 2023
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.
- Affected versions
-
max 5.1.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-2499
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- May 16, 2023
- Research Description
- The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
- Affected versions
-
max 5.2.1.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-2548
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- May 16, 2023
- Research Description
- The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers, with administrator-level permissions and above, to change user passwords and potentially take over super-administrator accounts in multisite setup.
- Affected versions
-
max 5.2.1.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-51544
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jun 04, 2024
- Research Description
- Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
- Affected versions
-
max 5.2.5.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-50846
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 29, 2023
- Research Description
- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.
- Affected versions
-
max 5.2.4.6.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-51543
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jun 04, 2024
- Research Description
- Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
- Affected versions
-
max 5.2.5.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-51509
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 01, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Reflected XSS.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.1.
- Affected versions
-
max 5.2.4.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-47645
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Nov 30, 2023
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Cross Site Request Forgery.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.2.6.
- Affected versions
-
max 5.2.3.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-25935
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 11, 2024
- Research Description
- Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
- Affected versions
-
max 5.2.6.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-1991
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 10, 2024
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
- Affected versions
-
max 5.3.1.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-1990
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 10, 2024
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 5.3.2.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-33947
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- May 03, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.3.2.0.
- Affected versions
-
max 5.3.2.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-29113
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 19, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
- Affected versions
-
max 5.2.6.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-2951
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 26, 2024
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0.
- Affected versions
-
max 5.3.1.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2023-49831
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 09, 2024
- Research Description
- Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 5.2.3.0.
- Affected versions
-
max 5.2.3.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-39643
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Aug 02, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RegistrationMagic Forms RegistrationMagic allows Stored XSS.This issue affects RegistrationMagic: from n/a through 6.0.0.1.
- Affected versions
-
max 6.0.0.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-43317
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Aug 20, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic allows Cross-Site Scripting (XSS).This issue affects RegistrationMagic: from n/a through 6.0.1.0.
- Affected versions
-
max 6.0.1.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-10508
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Nov 09, 2024
- Research Description
- The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.
- Affected versions
-
max 6.0.2.7.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-24686
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 31, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Reflected XSS.This issue affects RegistrationMagic: from n/a through <= 6.0.3.3.
- Affected versions
-
max 6.0.3.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-2836
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Apr 04, 2025
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 6.0.4.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2024-9390
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- May 16, 2025
- Research Description
- The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 6.0.2.1.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2017-20208
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Oct 18, 2025
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
- Affected versions
-
max 3.7.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-11204
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Oct 08, 2025
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
- Affected versions
-
max 6.0.6.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-13610
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 15, 2025
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 6.0.6.8.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-24374
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 22, 2026
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through <= 6.0.6.9.
- Affected versions
-
max 6.0.7.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-15403
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 17, 2026
- Research Description
- The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
- Affected versions
-
max 6.0.7.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-14444
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 18, 2026
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
- Affected versions
-
max 6.0.7.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2025-15520
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 13, 2026
- Research Description
- The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
- Affected versions
-
max 6.0.7.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-32498
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 25, 2026
- Research Description
- Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Affected versions
-
max 6.0.7.7.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-32385
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 14, 2026
- Research Description
- Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Affected versions
-
max 6.0.7.7.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-24373
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 25, 2026
- Research Description
- Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.
- Affected versions
-
max 6.0.7.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-0929
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 16, 2026
- Research Description
- The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
- Affected versions
-
max 6.0.7.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-1054
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 28, 2026
- Research Description
- The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
- Affected versions
-
max 6.0.7.5.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-49764
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jun 16, 2026
- Research Description
- Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
- Affected versions
-
max 6.0.8.7.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 2f73ef72d374acb83b4fbbd426ca7b2a7f4c3b6e
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 27, 2021
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 5.0.1.9 WordPress RegistrationMagic plugin <= 5.0.1.8 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress RegistrationMagic plugin (versions <= 5.0.1.8).
- Affected versions
-
max 5.0.1.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # c80f0c50fedb1b0a8e83af4eb5e17687da888b0a
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Oct 03, 2017
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 3.7.9.3 WordPress RegistrationMagic-Custom Registration Forms plugin <= 3.7.9.2 - Unauthenticated PHP Object Injection vulnerability Unauthenticated PHP Object Injection vulnerability found by Matt Barry (WordFence) in WordPress RegistrationMagic-Custom Registration Forms plugin (versions <= 3.7.9.2).
- Affected versions
-
max 3.7.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 4e04f867f13d0d46226b1eaae52a0d510400aea9
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 10, 2017
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 3.8.0.9 RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - SQL Injection The RegistrationMagic - Custom Registration Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'rm_form_id' field in versions up to, and including, 3.8.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 3.8.0.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # cba736bac15ca03bbdfa5c8ff43e4c713beb7d69
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Mar 05, 2020
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 4.6.0.4 WordPress RegistrationMagic plugin <= 4.6.0.3 - Multiple Critical vulnerabilities Multiple Critical vulnerabilities found by Ram Gall in the WordPress RegistrationMagic plugin (versions <= 4.6.0.3).
- Affected versions
-
max 4.6.0.4.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 7cffaab45f1728ee1b495ed6837c549decb8c0fa
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jan 30, 2020
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 4.6.0.3 WordPress RegistrationMagic plugin <= 4.6.0.1 - Authenticated SQL Injection (SQLi) vulnerability Authenticated SQL Injection (SQLi) vulnerability found by Spider Sec Ltd. in WordPress RegistrationMagic plugin (versions <= 4.6.0.1).
- Affected versions
-
max 4.6.0.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 9428bb45-1b95-4d10-9870-f232cbf89000
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- -
- Research Description
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager] < 5.0.1.9 Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting The plugin does not properly sanitise and escape an arbitrary GET parameter before outputting back in an attribute when generating the Log pagination, leading to a Reflected Cross-Site Scripting
- Affected versions
-
max 5.0.1.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # ca78b287-7371-4bbd-88b8-6b91ed786b2e
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- -
- Research Description
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager] < 3.8.0.9 RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated Reflected XSS The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms <= 3.8.0.4 - Authenticated Reflected XSS security vulnerability.
- Affected versions
-
max 3.8.0.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 91a4000113dd895d11f85ef80c4230fa8a835474
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Oct 02, 2017
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 3.7.9.3 RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
- Affected versions
-
max 3.7.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 5f6420cc-5257-48bb-9ad8-f363d72b0bb0
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- -
- Research Description
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager] < 3.8.0.9 RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated SQL Injection The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms <= 3.8.0.4 - Authenticated SQL Injection security vulnerability.
- Affected versions
-
max 3.8.0.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 6d9880d6-d32b-4f4d-ad7c-d438e369c49c
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- -
- Research Description
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager] < 3.7.9.3 wpscan.com
- Affected versions
-
max 3.7.9.3.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 5bece25e9a9c349683b7ba34263474fdeaf77e15
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Dec 10, 2017
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 3.8.0.9 RegistrationMagic - Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 3.8.0.9.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # 527bb39f78423bbe9b0f52c50c26f799e2de3d52
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Oct 07, 2023
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 5.2.4.2 RegistrationMagic <= 5.2.4.1 - Reflected Cross-Site Scripting via section_id The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘section_id’ parameter in versions up to, and including, 5.2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 5.2.4.2.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # dd9693b337972b511204a0a13bacb7cdf2f89de9
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Feb 20, 2024
- Research Description
- RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager] < 5.2.6.0 RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5.9. This is due to missing or incorrect nonce validation on the rm_options_default_payment_method() function. This makes it possible for unauthenticated attackers to update the default payment method via a forged request granted they can trick an authenticated site user into performing an action such as clicking on a link.
- Affected versions
-
max 5.2.6.0.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-9242
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jun 27, 2026
- Research Description
- The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's `user_id` with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.
- Affected versions
-
max 6.0.8.7.
- Status
-
vulnerable
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login # CVE-2026-12158
- CVE, Research URL
- Home page URL
- Application
-
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Date
- Jul 01, 2026
- Research Description
- The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 6.0.9.2.
- Status
-
vulnerable