---
id: "CVE-2026-110987"
page: "https://infrastack.ai/live/CVE-2026-110987"
kind: "vulnerability"
aliases: ["CVE-2026-110987"]
title: "RegistrationMagic WordPress plugin: unescaped value lets attackers run admin-side scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "RegistrationMagic", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "rregistrationmagic", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-6.1.0.4-or-later"]
published_at: "2026-11-15T07:16:53+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:36:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110987", "first_seen_at": "2026-11-15T07:36:11+00:00"}]
exploit_sources: []
---

# RegistrationMagic WordPress plugin: unescaped value lets attackers run admin-side scripts

Link for people: https://infrastack.ai/live/CVE-2026-110987 (this .md is for agents)

The RegistrationMagic WordPress plugin before 6.1.0.4 prints a user-supplied value inside an inline script on several admin screens without escaping it. An attacker who tricks a logged-in administrator into opening a crafted link can run arbitrary JavaScript in that administrator's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RegistrationMagic affected range not listed fixed no fixed version listed

## How to check

- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins, or in the plugin's main file header.
- Confirm whether any WordPress administrators use the site's admin screens from links they receive by email or chat.

## Fix

- RegistrationMagic plugin: `6.1.0.4` or later, per the advisory's stated range (before 6.1.0.4 is affected).

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110987

## From the sources

The RegistrationMagic  WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_