RegistrationMagic <= 6.1.0.0 - Unauthenticated Reflected Cross-Site Scripting via 'total_price' and 'description' Parameters
- ID
- WPSEC-2026-0316
- Plugin
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (custom-registration-form-builder-with-submission-manager)
- Affected
- from 6.0.0.0 before 6.1.0.1
- Remediation
- Update to 6.1.0.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- RegistrationMagic on WPSec AttackSurface
- Fix released
- Published
Description
The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'total_price' and 'description' parameters in versions 6.0.0.0 up to, and including, 6.1.0.0. When a page containing a form published with the [RM_Forms] shortcode or block is requested with a 'payment_intent_client_secret' parameter, the plugin renders a Stripe payment form whose data attributes contain these request values after only sanitize_text_field and wp_kses_post, neither of which escapes double quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user, such as an administrator, into clicking a crafted link. The code path loads a RegistrationMagic Premium asset, so on PHP 8 it is only reachable on sites where the Premium add-on is active; on PHP 7 it is reachable with the free plugin alone.
References
- https://wpsec.com/vuln/WPSEC-2026-0316/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.1/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS