RC
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 5Medium 6Low 0
Watch
Add RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-15403 | 9.8 | Jan 17 | RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order Affected: through 6.0.7.1 |
| CVE-2017-20208 | 9.8 | Oct 18 | RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection Affected: before 3.7.9.3 |
| CVE-2024-10508 | 9.8 | Nov 9 | RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery Affected: through 6.0.2.6 |
| CVE-2023-2499 | 9.8 | May 16 | RegistrationMagic <= 5.2.1.0 - Authentication Bypass Affected: through 5.2.1.0 |
| CVE-2026-12158 | 8.8 | Jul 1 | RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter Affected: through 6.0.9.1 |
| CVE-2024-1991 | 8.8 | Apr 9 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation Affected: through 5.3.0.0 |
| CVE-2024-1990 | 8.8 | Apr 9 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode Affected: through 5.3.1.0 |
| CVE-2025-11204 | 7.2 | Oct 8 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection Affected: through 6.0.6.2 |
| CVE-2023-2548 | 7.2 | May 16 | RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change Affected: through 5.2.0.5 |
| CVE-2025-13610 | 6.4 | Dec 15 | RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode Affected: through 6.0.6.7 |
| CVE-2025-2836 | 6.4 | Apr 4 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 6.0.4.3 |
| CVE-2023-51509 | 6.1 | Feb 1 | WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) Affected: through 5.2.4.1 |
| CVE-2026-9242 | 5.3 | Jun 27 | RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request Affected: through 6.0.8.6 |
| CVE-2025-14444 | 5.3 | Feb 18 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment Affected: through 6.0.6.9 |
| CVE-2026-1054 | 5.3 | Jan 28 | RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification Affected: through 6.0.7.4 |
Showing 15