CVE Tools
Track your stack

Registrationmagic – Custom Registration Forms, User Registration, Payment, and User Login

17 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Registrationmagic – Custom Registration Forms, User Registration, Payment, and User Login, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Registrationmagic – Custom Registration Forms, User Registration, Payment, and User Login CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Registrationmagic – Custom Registration Forms, User Registration, Payment, and User Login CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-102
2025-110
2025-121
2026-012
2026-021
2026-030
2026-040
2026-050
2026-061
2026-071
2026-080
2026-090
2026-100

Severity

How the 17 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical424%
  • High635%
  • Medium741%

Latest CVEs

The 15 most recently published vulnerabilities affecting Registrationmagic – Custom Registration Forms, User Registration, Payment, and User Login.

  1. CVE-2026-12158RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter8.8
  2. CVE-2026-9242RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request5.3
  3. CVE-2025-14444RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment5.3
  4. CVE-2026-1054RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification5.3
  5. CVE-2025-15403RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order9.8
  6. CVE-2025-13610RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode6.4
  7. CVE-2017-20208RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection9.8
  8. CVE-2025-11204RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection7.2
  9. CVE-2025-2836RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4
  10. CVE-2024-10508RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery9.8
  11. CVE-2024-1991RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation8.8
  12. CVE-2024-1990RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode8.8
  13. CVE-2023-51509WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)7.1
  14. CVE-2023-50846WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection7.6
  15. CVE-2023-47645WordPress RegistrationMagic Plugin <= 5.2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)4.3

Product grouping is registry-driven, with AI assist and human review. How it works