# RegistrationMagic.

Every CVE that names RegistrationMagic among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation](https://agentprime.io/advisories/CVE-2026-77826.md)
  `CVE-2026-77826` · CVE record: Unknown RegistrationMagic · CVSS 8.8 High · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity](https://agentprime.io/advisories/CVE-2026-77794.md)
  `CVE-2026-77794` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-472
- [RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field](https://agentprime.io/advisories/CVE-2026-77793.md)
  `CVE-2026-77793` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-602
- [RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field](https://agentprime.io/advisories/CVE-2026-77792.md)
  `CVE-2026-77792` · CVE record: Unknown RegistrationMagic · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS)
- [RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter](https://agentprime.io/advisories/CVE-2026-77790.md)
  `CVE-2026-77790` · CVE record: Unknown RegistrationMagic · CVSS 5.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection
- [RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification](https://agentprime.io/advisories/CVE-2026-15208.md)
  `CVE-2026-15208` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification](https://agentprime.io/advisories/CVE-2026-15257.md)
  `CVE-2026-15257` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control
- [RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-15255.md)
  `CVE-2026-15255` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control
- [RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation](https://agentprime.io/advisories/CVE-2026-0929.md)
  `CVE-2026-0929` · CVE record: Unknown RegistrationMagic · CVSS 4.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: Broken access control
- [RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure](https://agentprime.io/advisories/CVE-2025-15520.md)
  `CVE-2025-15520` · CVE record: Unknown RegistrationMagic · CVSS 4.3 Medium · Not analysed yet · Published 13 Feb 2026
- [RegistrationMagic < 6.0.2.1 - Stored XSS](https://agentprime.io/advisories/CVE-2024-9390.md)
  `CVE-2024-9390` · CVE record: Unknown RegistrationMagic · CVSS 4.8 Medium · Not analysed yet · Published 15 May 2025
- [WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2024-39643.md)
  `CVE-2024-39643` · CVE record: RegistrationMagic Forms RegistrationMagic · CVSS 5.8 Medium · Not analysed yet · Published 1 Aug 2024 · Tags: Cross-site scripting (XSS)
- [WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)](https://agentprime.io/advisories/CVE-2023-25991.md)
  `CVE-2023-25991` · CVE record: RegistrationMagic RegistrationMagic · CVSS 5.4 Medium · Not analysed yet · Published 13 Mar 2023 · Tags: Cross-site request forgery (CSRF)
- [RegistrationMagic <= 5.0.1.7 Authentication Bypass](https://agentprime.io/advisories/CVE-2021-4073.md)
  `CVE-2021-4073` · CVE record: RegistrationMagic RegistrationMagic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2021 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=registrationmagic>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/registrationmagic/>. Everything for agents: <https://agentprime.io/llms.txt>.