CVE-2026-77792: CWE-79 Cross-Site Scripting (XSS) in RegistrationMagic

The RegistrationMagic WordPress plugin versions prior to 6.0.9.9 fail to escape a registration form field value before rendering it within an HTML attribute on an administrative page. This improper output encoding enables unauthenticated attackers to perform stored Cross-Site Scripting (CWE-79) attacks, potentially executing arbitrary scripts in the context of high privilege users like admins. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow unauthenticated attackers to execute arbitrary JavaScript in the context of administrative users. This may lead to theft of sensitive information, session hijacking, or other malicious actions performed with admin privileges. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, consider restricting access to the administrative interface and monitoring for suspicious activity related to form inputs.