PT-2020-20136 · WordPress · Registrationmagic

Published 2020-03-12 · Updated 2022-01-21 · CVE-2020-8436

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RegistrationMagic plugin version 4.6.0.0 for WordPress

Description A cross-site scripting issue was found in the RegistrationMagic plugin for WordPress. The issue can be exploited via the rm form id, rm tr, or form name parameter.

Recommendations For RegistrationMagic plugin version 4.6.0.0, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the parameters rm form id, rm tr, and form name to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8436

Affected Products

Registrationmagic

References · 5

• 🔥 https://spider-security.co.uk/blog-cve-2020-8436 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8436 · Security Note
• https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers · Note
• https://spider-security.co.uk · Note