Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-110984

RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Registrationmagic
CVE-2026-110987

RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Registrationmagic
CVE-2026-110989

RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Registrationmagic