RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

Description

The plugin does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Exploitation requires the affected field type to be present on a published form and configured to display on the registrant profile page, and the plugin's premium add-on not to be active.