{"id":"CVE-2026-110987","kind":"vulnerability","aliases":["CVE-2026-110987"],"related":[],"title":"RegistrationMagic WordPress plugin: unescaped value lets attackers run admin-side scripts","description":"The RegistrationMagic  WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.","summary":"The RegistrationMagic WordPress plugin before 6.1.0.4 prints a user-supplied value inside an inline script on several admin screens without escaping it. An attacker who tricks a logged-in administrator into opening a crafted link can run arbitrary JavaScript in that administrator's session.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RegistrationMagic","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","rregistrationmagic","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-6.1.0.4-or-later"],"how_to_check":"- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether any WordPress administrators use the site's admin screens from links they receive by email or chat.","fix":"- RegistrationMagic plugin: `6.1.0.4` or later, per the advisory's stated range (before 6.1.0.4 is affected).","status":"open","published_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:25+00:00","updated_at":"2026-11-15T07:36:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T07:36:25Z","model":"claude-haiku-5-5","output":{"fix":"- RegistrationMagic plugin: `6.1.0.4` or later, per the advisory's stated range (before 6.1.0.4 is affected).","reach":"internet","title":"RegistrationMagic WordPress plugin: unescaped value lets attackers run admin-side scripts","impact":"medium","summary":"The RegistrationMagic WordPress plugin before 6.1.0.4 prints a user-supplied value inside an inline script on several admin screens without escaping it. An attacker who tricks a logged-in administrator into opening a crafted link can run arbitrary JavaScript in that administrator's session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","rregistrationmagic","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in an administrator's browser session.","analyst_note":"Confirm the fixed version and any vendor advisory at the NVD entry, since no product data or fix statement was supplied.","how_to_check":"- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether any WordPress administrators use the site's admin screens from links they receive by email or chat.","plain_action":"","product_name":"RegistrationMagic","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-6.1.0.4-or-later"],"who_is_affected":"Sites running the RegistrationMagic plugin older than 6.1.0.4 are exposed, and the risk falls on administrators who open links while logged in. Sites without the plugin, or running 6.1.0.4 or later, are not affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4561,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110987':15A,18A '-2026':14A,17A '6.1.0.4':31B,77C 'admin':10A,44B,99C 'admin-sid':9A 'administr':57B,69B,115C 'allow':101C 'arbitrari':65B,106C 'attack':7A,50B,103C 'block':94C 'craft':61B,122C 'cve':13A,16A 'escap':47B,81C 'execut':109C 'host':24B 'inject':105C 'inlin':40B,92C 'insid':38B,90C 'javascript':66B,107C 'let':6A 'link':62B,123C 'log':55B 'logged-in':54B 'open':59B,120C 'packag':20B 'plugin':3A,29B,75C 'print':32B,88C 'proper':80C 'registrationmag':1A,27B,73C 'registrationmagic':19A 'rregistrationmag':21B 'run':8A,64B 'screen':45B,100C 'script':12A,41B,93C 'self':23B 'self-host':22B 'session':71B,112C 'sever':43B,96C 'side':11A 'suppli':36B,85C 'trick':52B,118C 'unauthent':102C 'unescap':4A 'user':35B,84C 'user-suppli':34B,83C 'valu':5A,37B,86C 'without':46B 'wordpress':2A,25B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the RegistrationMagic plugin older than 6.1.0.4 are exposed, and the risk falls on administrators who open links while logged in. Sites without the plugin, or running 6.1.0.4 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["registrationmagic"],"ptokens":["registrationmagic"],"labels":["medium","package","rregistrationmagic","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-110987':15A,18A '-2026':14A,17A 'admin':10A 'admin-sid':9A 'attack':7A 'cve':13A,16A 'let':6A 'plugin':3A 'registrationmag':1A 'registrationmagic':19A 'run':8A 'script':12A 'side':11A 'unescap':4A 'valu':5A 'wordpress':2A","search_b":"'6.1.0.4':31B 'admin':44B 'administr':57B,69B 'arbitrari':65B 'attack':50B 'craft':61B 'escap':47B 'host':24B 'inlin':40B 'insid':38B 'javascript':66B 'link':62B 'log':55B 'logged-in':54B 'open':59B 'packag':20B 'plugin':29B 'print':32B 'registrationmag':27B 'rregistrationmag':21B 'run':64B 'screen':45B 'script':41B 'self':23B 'self-host':22B 'session':71B 'sever':43B 'suppli':36B 'trick':52B 'user':35B 'user-suppli':34B 'valu':37B 'without':46B 'wordpress':25B,28B","search_c":"'6.1.0.4':77C 'admin':99C 'administr':115C 'allow':101C 'arbitrari':106C 'attack':103C 'block':94C 'craft':122C 'escap':81C 'execut':109C 'inject':105C 'inlin':92C 'insid':90C 'javascript':107C 'link':123C 'open':120C 'plugin':75C 'print':88C 'proper':80C 'registrationmag':73C 'screen':100C 'script':93C 'session':112C 'sever':96C 'suppli':85C 'trick':118C 'unauthent':102C 'user':84C 'user-suppli':83C 'valu':86C 'wordpress':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110987","severity":null,"published_at":"2026-11-15T07:16:53+00:00","modified_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}