gabrielftanaka/cve-2026-82221-pocPoC for Unauthenticated Reflected Cross-Site Scripting (XSS) in RegistrationMagic WordPress Plugin
This repository contains a Proof-of-Concept (PoC) for CVE-2026-82221, an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in the RegistrationMagic WordPress plugin.
The vulnerability affects the activetab parameter on the RegistrationMagic submissions page.
An attacker can craft a malicious URL containing JavaScript and send it to a victim who has access to a RegistrationMagic submission. When the victim opens the crafted URL, attacker-controlled JavaScript is executed in the context of the vulnerable WordPress website.
A relevant aspect of the vulnerability is that an attacker may be able to create the required submission on behalf of the victim if a publicly accessible RegistrationMagic form allows arbitrary email addresses to be submitted.
This repository is provided for educational and security research purposes only.
| Field | Value |
|---|
| CVE | CVE-2026-82221 |
| Product | RegistrationMagic |
| Vendor | Metagauss |
| Platform | WordPress |
| Vulnerability Type | Reflected Cross-Site Scripting (XSS) |
| Authentication Required | No authentication required to inject the payload |
| Affected Versions | RegistrationMagic <= 6.0.9.8 |
| Fixed Version | RegistrationMagic 6.0.9.9 |
| CVSS | 7.1 (High) |
| Researcher | Gabriel Tanaka |
For successful exploitation, the victim must have a RegistrationMagic submission that can be accessed through the /submissions/ functionality.
This condition can occur in two scenarios:
The victim has previously submitted a RegistrationMagic form and already has an accessible submission.
A public RegistrationMagic form allows an attacker to submit a form using the victim's email address, effectively creating a submission associated with that victim.
Once this prerequisite is satisfied, the attacker can send the victim a specially crafted URL containing the XSS payload.
The vulnerable parameter is:
activetab
Example vulnerable endpoint:
https://target.example/submissions/?activetab=PAYLOAD
User-controlled input supplied through activetab is reflected into the page without sufficient output sanitization/escaping, allowing JavaScript execution.
A simple payload can be used to demonstrate arbitrary JavaScript execution:
https://target.example/submissions/?activetab=alert(`xss`)
https://target.example/submissions/?activetab=alert(document.cookie)
Patchstack Vulnerability Database
https://patchstack.com/database/wordpress/plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
GitHub Advisory Database
https://github.com/advisories/GHSA-gfh3-73rq-r627
RegistrationMagic
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
RegistrationMagic Changelog
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers