RegistrationMagic <= 6.1.0.3 - Unauthenticated Reflected Cross-Site Scripting via 'rm_tr' Parameter
- ID
- WPSEC-2026-3015
- Plugin
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (custom-registration-form-builder-with-submission-manager)
- Affected
- all versions before 6.1.0.4
- Remediation
- Update to 6.1.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- RegistrationMagic on WPSec AttackSurface
- Fix released
- Published
Description
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rm_tr' timerange parameter on the Form Analytics, Form Dashboard (Form Settings), Login Dashboard and Login Analytics admin screens in all versions up to, and including, 6.1.0.3. This is due to insufficient input sanitization and output escaping: the value is only passed through sanitize_text_field() and is printed unquoted into an inline JavaScript block with HTML escaping only. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick an administrator into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-3015/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS