{
 "id": "WPSEC-2026-3015",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3015/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3015/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3015/index.md",
 "title": "RegistrationMagic <= 6.1.0.3 - Unauthenticated Reflected Cross-Site Scripting via 'rm_tr' Parameter",
 "description": "The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rm_tr' timerange parameter on the Form Analytics, Form Dashboard (Form Settings), Login Dashboard and Login Analytics admin screens in all versions up to, and including, 6.1.0.3. This is due to insufficient input sanitization and output escaping: the value is only passed through sanitize_text_field() and is printed unquoted into an inline JavaScript block with HTML escaping only. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick an administrator into clicking a crafted link.",
 "plugin": {
  "slug": "custom-registration-form-builder-with-submission-manager",
  "name": "RegistrationMagic",
  "full_name": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login",
  "wordpress_org": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/custom-registration-form-builder-with-submission-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.1.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.1.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.1.0.4",
 "remediation": "Update to 6.1.0.4 or later.",
 "fix_released": "2026-11-12T04:37:11+00:00",
 "published": "2026-11-13T04:42:27+00:00",
 "updated": "2026-11-12T17:14:28.652070+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3015/",
  "https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/",
  "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}