Unknown Registrationmagic vulnerabilities

10 CVEs affecting Unknown Registrationmagic, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77826, published 2026-09-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77826, published 2026-09-05. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated…
CVE-2026-77792, published 2026-09-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated…
CVE-2026-77794, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users…
CVE-2026-77793, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without…
CVE-2026-15255, published 2026-07-30. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end…
CVE-2026-15257, published 2026-07-30. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to…
CVE-2026-77790, published 2026-08-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL…
CVE-2026-0929, published 2026-02-16. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
CVE-2025-15520, published 2026-02-13. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
CVE-2026-15208, published 2026-08-06. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side…