Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: RegistrationMagic 6.0.9.9 Clear all filters
TI-2026-54183 CVE-2026-77794 · GHSA-238j-h296-6wrg

RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

Priority LOW 30

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without pa…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2026-09-02 Fixed in 6.0.9.9 CWE-472
TI-2026-54182 CVE-2026-77793 · GHSA-6gqp-ppxj-7jmc

RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

Priority LOW 30

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an acti…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2026-09-02 Fixed in 6.0.9.9 CWE-602
TI-2026-54181 CVE-2026-77792 · GHSA-f46j-549q-7cwg

RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

Priority LOW 35

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00373 Published 2026-09-02 Fixed in 6.0.9.9 CWE-79