Extension WordPress
Vulnérabilités RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, page 2
Cette page rassemble les failles publiées pour RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
51 fiches
RegistrationMagic <= 5.3.2.0 – Reflected Cross-Site Scripting
The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 5.3.2.0 due to insufficient input sanitization and output escaping. This makes it…
*-5.3.2.0
5.3.2.1
30/04/2024
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 – Authenticated (Contributor+) SQL Injection via Shortcode
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due…
*-5.3.1.0
5.3.2.0
26/03/2024
RegistrationMagic <= 5.3.0.0 – Cross-Site Request Forgery
The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.0.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to…
*-5.3.0.0
5.3.1.0
26/03/2024
RegistrationMagic <= 5.2.5.9 – Reflected Cross-Site Scripting
The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-5.2.5.9
5.2.6.0
16/03/2024
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 – Authenticated (Subscriber+) Privilege Escalation
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0.…
*-5.3.0.0
5.3.1.0
14/03/2024
RegistrationMagic <= 5.2.5.9 – Cross-Site Request Forgery
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5.9. This is due to missing or incorrect nonce validation…
*-5.2.5.9
5.2.6.0
20/02/2024
RegistrationMagic <= 5.2.5.0 – Form Submission Limit Bypass
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to form submission limit bypass in all versions up to, and including, 5.2.5.0 due to insufficient protection logic. This makes it…
*-5.2.5.0
5.2.5.1
27/12/2023
RegistrationMagic <= 5.2.5.0 – IP Spoofing
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.5.0 due to use of user-supplied HTTP headers as a…
*-5.2.5.0
5.2.5.1
27/12/2023
RegistrationMagic Plugin <= 5.2.4.5 – Authenticated(Administrator+) SQL Injection
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to and including 5.2.4.5 due to insufficient escaping on the…
[*, 5.2.4.6)
5.2.4.6
21/12/2023
RegistrationMagic <= 5.2.3.0 – Missing Authorization
The RegistrationMagic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_user_profile() function in versions up to, and including, 5.2.3.0. This makes it possible for unauthenticated attackers to update…
*-5.2.3.0
5.2.3.1
05/12/2023
RegistrationMagic <= 5.2.2.6 – Cross-Site Request Forgery
The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2.2.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers…
*-5.2.2.6
5.2.3.0
27/11/2023
RegistrationMagic <= 5.2.4.1 – Reflected Cross-Site Scripting via section_id
The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘section_id’ parameter in versions up to, and including, 5.2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
[*, 5.2.4.2)
5.2.4.2
07/10/2023
RegistrationMagic <= 5.2.1.0 – Authentication Bypass
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes…
*-5.2.1.0
5.2.1.1
15/05/2023
RegistrationMagic <= 5.2.0.5 – Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system…
*-5.2.0.5
5.2.1.0
12/05/2023
RegistrationMagic <= 5.1.9.2 – Cross-Site Request Forgery leading to Form Metadata Deletion
The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.9.2. This is due to missing or incorrect nonce validation on the 'remove' function inside the 'class_rm_form_controller.php' file. This makes it…
*-5.1.9.2
5.1.9.3
17/02/2023
RegistrationMagic <= 5.1.9.2 – Improper Authorization to Price Change
The RegistrationMagic plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 5.1.9.2. This makes it possible for unauthenticated attackers to alter the price of registrations.
*-5.1.9.2
5.1.9.3
20/01/2023
RegistrationMagic <= 5.1.9.2 – Missing Authorization to Unauthenticated Content Injection
The RegistrationMagic plugin for WordPress is vulnerable to content injection in versions up to, and including, 5.1.9.2. This is due to insufficient authorization checks. This makes it possible for unauthenticated attackers to alter the content on select pages.
*-5.1.9.2
5.1.9.3
20/01/2023
RegistrationMagic <= 5.0.2.1 – SQL Injection
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
[*, 5.0.2.2)
5.0.2.2
07/02/2022
RegistrationMagic <= 5.0.1.5 – SQL Injection
The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue
*-5.0.1.5
5.0.1.6
23/01/2022
Registration Magic <= 5.0.1.8 – Reflected Cross-Site Scripting
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
*-5.0.1.8
5.0.1.9
28/12/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.