Plugin icon

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

custom-registration-form-builder-with-submission-manager

Vulnerabilities:

34

Last Updated:

January 5, 2026

Active Installs:

9000

Published
Title
Fixed in
CVSS
Published
2025-12-15
Title
RegistrationMagic < 6.0.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
Fixed in
Fixed in 6.0.6.8
CVSS
6.4 (medium)
Published
2025-10-07
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.6.3 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 6.0.6.3
CVSS
7.2 (high)
Published
2025-04-02
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.4.4
CVSS
6.4 (medium)
Published
2025-01-28
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.3.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.0.3.4
CVSS
6.1 (medium)
Published
2024-11-08
Title
RegistrationMagic – User Registration Plugin with Custom Registration Forms < 6.0.2.7 - Unauthenticated Privilege Escalation via Password Recovery
Fixed in
Fixed in 6.0.2.7
CVSS
9.8 (critical)
Published
2024-09-25
Title
RegistrationMagic < 6.0.2.1 - Stored XSS
Fixed in
Fixed in 6.0.2.1
CVSS
3.5 (low)
Published
2024-08-16
Title
RegistrationMagic < 6.0.1.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.1.1
CVSS
7.2 (high)
Published
2024-08-01
Title
RegistrationMagic < 6.0.0.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 6.0.0.2
CVSS
7.2 (high)
Published
2024-04-30
Title
RegistrationMagic < 5.3.2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.3.2.1
CVSS
6.1 (medium)
Published
2024-03-26
Title
RegistrationMagic < 5.3.1.0 - Cross-Site Request Forgery
Fixed in
Fixed in 5.3.1.0
CVSS
4.3 (medium)
Published
2024-03-26
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 5.3.2.0 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 5.3.2.0
CVSS
8.8 (high)
Published
2024-03-16
Title
RegistrationMagic < 5.2.6.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.2.6.0
CVSS
6.1 (medium)
Published
2024-03-14
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 5.3.1.0 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 5.3.1.0
CVSS
8.8 (high)
Published
2024-02-20
Title
RegistrationMagic < 5.2.6.0 - Cross-Site Request Forgery
Fixed in
Fixed in 5.2.6.0
CVSS
4.3 (medium)
Published
2023-12-27
Title
RegistrationMagic < 5.2.5.1 - IP Spoofing
Fixed in
Fixed in 5.2.5.1
CVSS
5.3 (medium)
Published
2023-12-27
Title
RegistrationMagic < 5.2.5.1 - Form Submission Limit Bypass
Fixed in
Fixed in 5.2.5.1
CVSS
5.3 (medium)
Published
2023-12-21
Title
RegistrationMagic Plugin < 5.2.4.6 - Authenticated(Administrator+) SQL Injection
Fixed in
Fixed in 5.2.4.6
CVSS
6.6 (medium)
Published
2023-12-05
Title
RegistrationMagic < 5.2.3.1 - Missing Authorization
Fixed in
Fixed in 5.2.3.1
CVSS
5.3 (medium)
Published
2023-11-27
Title
RegistrationMagic < 5.2.3.0 - Cross-Site Request Forgery
Fixed in
Fixed in 5.2.3.0
CVSS
4.3 (medium)
Published
2023-10-07
Title
RegistrationMagic < 5.2.4.2 - Reflected Cross-Site Scripting via section_id
Fixed in
Fixed in 5.2.4.2
CVSS
6.1 (medium)
Published
2023-05-15
Title
RegistrationMagic < 5.2.1.1 - Unauthenticated Authentication Bypass
Fixed in
Fixed in 5.2.1.1
CVSS
9.8 (critical)
Published
2023-05-12
Title
RegistrationMagic < 5.2.1.0 - Admin+ Arbitrary Password Update via IDOR
Fixed in
Fixed in 5.2.1.0
CVSS
4.7 (medium)
Published
2023-02-17
Title
RegistrationMagic < 5.1.9.3 - Form Deletion via CSRF
Fixed in
Fixed in 5.1.9.3
CVSS
4.3 (medium)
Published
2022-02-07
Title
RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection
Fixed in
Fixed in 5.0.2.2
CVSS
6.8 (medium)
Published
2021-12-28
Title
Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.0.1.9
CVSS
7.5 (high)
Published
2021-12-27
Title
Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.0.1.9
CVSS
7.5 (high)
Published
2021-12-08
Title
Registration Magic < 5.0.1.8 - Authentication Bypass
Fixed in
Fixed in 5.0.1.8
CVSS
9.8 (critical)
Published
2021-12-08
Title
RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection
Fixed in
Fixed in 5.0.1.6
CVSS
6.8 (medium)
Published
2020-03-05
Title
RegistrationMagic – Custom Registration Forms and User Login < 4.6.0.4 - Multiple Critical Issues
Fixed in
Fixed in 4.6.0.4
CVSS
8.8 (high)
Published
2020-01-30
Title
Registration Magic < 4.6.0.3 - Authenticated SQL Injection via Form_id
Fixed in
Fixed in 4.6.0.3
CVSS
6.1 (medium)
Published
2020-01-30
Title
Registration Magic < 4.6.0.3 - Multiple Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.6.0.3
CVSS
8.1 (high)
Published
2017-12-10
Title
RegistrationMagic - Custom Registration Forms < 3.8.0.9 - Authenticated Reflected XSS
Fixed in
Fixed in 3.8.0.9
CVSS
n/a
Published
2017-12-10
Title
RegistrationMagic - Custom Registration Forms < 3.8.0.9 - Authenticated SQL Injection
Fixed in
Fixed in 3.8.0.9
CVSS
n/a
Published
2017-10-02
Title
RegistrationMagic-Custom Registration Forms <= 3.7.9.2 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.7.9.3
CVSS
n/a