CVE-2026-77792

RegistrationMagic before 6.0.9.9 fails to escape a registration form field value before inserting it into an HTML attribute on an administrative page, enabling Stored Cross-Site Scripting (CWE-79). An unauthenticated attacker submits a crafted value through a registration form exposed by the plugin; the payload is stored and later rendered into an HTML attribute when a privileged user, such as a site administrator, opens the affected admin page, at which point the script executes in the admin's browser (exploitation requires this admin interaction, matching the CVSS AC:H/UI:R scoring). With the admin's authenticated session, the attacker can create rogue administrator accounts, modify settings, or inject or alter site content. Any WordPress site running an affected version and exposing a registration form to unauthenticated visitors is affected. Exploitation status is quiet: no public proof of concept is known, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation within 30 days.

What to do: Update RegistrationMagic to 6.0.9.9 or later. Until patched, review recent unauthenticated registration submissions for unexpected HTML or attribute-injection payloads and consider restricting open registration on affected sites. After patching, check for newly created administrator accounts and unexplained settings or content changes, since a successful attack would have required an admin to view a malicious submission.