A high-severity stored XSS vulnerability in the RegistrationMagic WordPress plugin allows unauthenticated attackers to execute malicious scripts in the context of an administrator's session.

The plugin fails to escape user-supplied registration form data before rendering it within HTML attributes on administrative dashboards. This flaw allows an unauthenticated attacker to inject malicious JavaScript that executes when a high-privileged administrator views the affected page.

Successful exploitation poses a significant risk to the integrity and security of the WordPress administrative environment. An attacker could leverage this XSS to perform unauthorized administrative actions, steal session cookies, or redirect users to malicious sites. Given the CVSS score of 7.5, this vulnerability represents a high risk to organizational security, potentially leading to full site compromise if administrative accounts are hijacked.

Immediate Action: Update the RegistrationMagic WordPress plugin to version 6.0.9.9 or later immediately.

Proactive Monitoring: Review administrative audit logs for unusual activity or suspicious script execution patterns within the dashboard.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in form submissions.

Public Exploit Available: No

Organizations utilizing the RegistrationMagic plugin must prioritize patching to version 6.0.9.9 to eliminate this stored XSS vector. Failure to remediate could allow attackers to gain unauthorized control over administrative functions, undermining the security posture of the entire WordPress installation.