Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:06 UTC
CVE-2026-110987
The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:06 UTC
PublishedNov 15, 2026 06:00:06 UTC
ReservedOct 15, 2026 11:31:38 UTC
Credits
- Karthik Ramakrishnan
- WPScan