Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

• CVE-2026-12158 High 8.8 RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter 0.3%
• CVE-2026-9242 Medium 5.3 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request 0.3%
• CVE-2025-14444 Medium 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment 0.2%
• CVE-2026-1054 Medium 5.3 RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification 0.3%
• CVE-2025-15403 Critical 9.8 RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order 1.7%
• CVE-2025-13610 Medium 6.4 RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode 0.2%
• CVE-2025-11204 High 7.2 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection 0.4%
• CVE-2025-2836 Medium 6.4 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.3%
• CVE-2024-10508 Critical 9.8 RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery 1.5%
• CVE-2024-1991 High 8.8 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation 0.9%
• CVE-2024-1990 High 8.8 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode 0.8%
• CVE-2023-51509 High 7.1 WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) 0.4%
• CVE-2023-2548 Medium 6.6 RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change 0.7%
• CVE-2023-2499 Critical 9.8 RegistrationMagic <= 5.2.1.0 - Authentication Bypass 1.3%