# RegistrationMagic <= 6.1.0.3 - Unauthenticated Reflected Cross-Site Scripting via 'rm_tr' Parameter

- **ID:** WPSEC-2026-3015
- **Plugin:** RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (`custom-registration-form-builder-with-submission-manager`), https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
- **Affected versions:** all versions before 6.1.0.4
- **Fixed in:** 6.1.0.4 (Update to 6.1.0.4 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3015/

## Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rm_tr' timerange parameter on the Form Analytics, Form Dashboard (Form Settings), Login Dashboard and Login Analytics admin screens in all versions up to, and including, 6.1.0.3. This is due to insufficient input sanitization and output escaping: the value is only passed through sanitize_text_field() and is printed unquoted into an inline JavaScript block with HTML escaping only. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick an administrator into clicking a crafted link.

## References

- https://wpsec.com/vuln/WPSEC-2026-3015/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3015/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.