cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-10508,https://securityvulnerability.io/vulnerability/CVE-2024-10508,Unauthenticated Attackers Can Escalate Privileges via Plugin Flaw,"The RegistrationMagic User Registration Plugin for WordPress is susceptible to a serious vulnerability that allows unauthenticated attackers to escalate privileges via account takeover. This issue stems from the plugin's inadequate validation of password reset tokens prior to allowing updates to user passwords. As a result, attackers can reset passwords for arbitrary users, including those with administrative privileges, and gain unauthorized access to sensitive accounts. The vulnerability exists in all versions up to and including 6.0.2.6, necessitating immediate attention and patching to mitigate risks associated with potential exploitation.",Wordpress,Registrationmagic – User Registration Plugin With Custom Registration Forms,9.8,CRITICAL,0.00044999999227002263,false,,false,false,false,,false,false,2024-11-09T07:35:07.908Z,0
CVE-2024-1991,https://securityvulnerability.io/vulnerability/CVE-2024-1991,Privilege Escalation Vulnerability in RegistrationMagic Plugin for WordPress,"The RegistrationMagic plugin for WordPress is exposed to a privilege escalation vulnerability due to inadequate capability checks associated with the update_users_role() function. This weakness is present in all versions up to and including 5.3.0.0, enabling authenticated attackers with subscriber-level access or higher to gain unauthorized administrative privileges. Site administrators should review and apply available patches immediately to safeguard against potential exploitation.",Wordpress,"Registrationmagic – Custom Registration Forms, User Registration, Payment, And User Login",8.8,HIGH,0.00044999999227002263,false,,false,false,false,,false,false,2024-04-09T18:58:59.144Z,0
CVE-2024-1990,https://securityvulnerability.io/vulnerability/CVE-2024-1990,Blind SQL Injection Vulnerability in RegistrationMagic Plugin for WordPress,"The RegistrationMagic plugin for WordPress is susceptible to blind SQL injection vulnerabilities through the 'id' parameter of the RM_Form shortcode. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. As a result, authenticated attackers with contributor-level access or higher can insert malicious SQL queries into the existing database queries. The exploitation of this vulnerability could allow unauthorized access to sensitive data stored in the database, posing significant security risks for websites utilizing this plugin.",Wordpress,"Registrationmagic – Custom Registration Forms, User Registration, Payment, And User Login",8.8,HIGH,0.00044999999227002263,false,,false,false,false,,false,false,2024-04-09T18:58:52.047Z,0
CVE-2023-2548,https://securityvulnerability.io/vulnerability/CVE-2023-2548,Insecure Direct Object References in RegistrationMagic Plugin for WordPress,"The RegistrationMagic plugin for WordPress has a vulnerability that allows authenticated users to bypass authorization and gain unauthorized access to sensitive system resources. Specifically, versions up to and including 5.2.0.5 permit attackers with administrative privileges to manipulate user access, which can result in the alteration of user passwords and the potential compromise of super-administrator accounts within a multisite environment.",Wordpress,"RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login",7.2,HIGH,0.0010300000431016088,false,,false,false,false,,false,false,2023-05-16T09:15:00.000Z,0
CVE-2023-2499,https://securityvulnerability.io/vulnerability/CVE-2023-2499,Authentication Bypass in RegistrationMagic Plugin for WordPress,"The RegistrationMagic plugin for WordPress contains a security flaw that allows attackers to bypass authentication by exploiting insufficient verification during Google social login. This vulnerability can let malicious users gain unauthorized access to existing user accounts, including those of administrators, if they know the associated email addresses. Addressing this issue is crucial to safeguarding user data and ensuring the integrity of WordPress sites using the plugin.",Wordpress,"RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login",9.8,CRITICAL,0.0021100000012665987,false,,false,false,false,,false,false,2023-05-16T09:15:00.000Z,0
CVE-2022-0420,https://securityvulnerability.io/vulnerability/CVE-2022-0420,RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection,"The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks",Wordpress,"Registrationmagic – Custom Registration Forms, User Registration And User Login Plugin",7.2,HIGH,0.00139999995008111,false,,false,false,false,,false,false,2022-03-07T08:16:33.000Z,0
CVE-2021-24648,https://securityvulnerability.io/vulnerability/CVE-2021-24648,Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting,"The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting",Wordpress,Registrationmagic,6.1,MEDIUM,0.0007399999885819852,false,,false,false,false,,false,false,2022-02-01T12:21:19.000Z,0
CVE-2021-24862,https://securityvulnerability.io/vulnerability/CVE-2021-24862,RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection,"The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue",Wordpress,"Registrationmagic – Custom Registration Forms, User Registration And User Login Plugin",7.2,HIGH,0.9577599763870239,false,,false,false,false,,false,false,2022-01-10T15:30:30.000Z,0
CVE-2021-4073,https://securityvulnerability.io/vulnerability/CVE-2021-4073,RegistrationMagic <= 5.0.1.7 Authentication Bypass,"The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.",Wordpress,Registrationmagic,9.8,CRITICAL,0.005239999853074551,false,,false,false,false,,false,false,2021-12-14T16:15:00.000Z,0
CVE-2020-8435,https://securityvulnerability.io/vulnerability/CVE-2020-8435,,An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.,Wordpress,Registrationmagic,8.1,HIGH,0.002219999907538295,false,,false,false,false,,false,false,2020-03-12T13:32:59.000Z,0
CVE-2020-8436,https://securityvulnerability.io/vulnerability/CVE-2020-8436,,"XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.",Wordpress,Registrationmagic,6.1,MEDIUM,0.001560000004246831,false,,false,false,false,,false,false,2020-03-12T13:31:59.000Z,0
CVE-2020-9458,https://securityvulnerability.io/vulnerability/CVE-2020-9458,,"In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.",Wordpress,Registrationmagic,8.8,HIGH,0.02167999930679798,false,,false,false,false,,false,false,2020-03-06T18:58:53.000Z,0
CVE-2020-9457,https://securityvulnerability.io/vulnerability/CVE-2020-9457,,"The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.",Wordpress,Registrationmagic,8.8,HIGH,0.02095000073313713,false,,false,false,false,,false,false,2020-03-06T18:56:35.000Z,0
CVE-2020-9456,https://securityvulnerability.io/vulnerability/CVE-2020-9456,,"In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.",Wordpress,Registrationmagic,8.8,HIGH,0.02167999930679798,false,,false,false,false,,false,false,2020-03-06T18:54:07.000Z,0
CVE-2020-9455,https://securityvulnerability.io/vulnerability/CVE-2020-9455,,The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.,Wordpress,Registrationmagic,4.3,MEDIUM,0.00171999994199723,false,,false,false,false,,false,false,2020-03-06T18:49:50.000Z,0
CVE-2020-9454,https://securityvulnerability.io/vulnerability/CVE-2020-9454,,"A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.",Wordpress,Registrationmagic,8.8,HIGH,0.023350000381469727,false,,false,false,false,,false,false,2020-03-06T18:43:13.000Z,0