WordPress custom-registration-form-builder-with-submission-manager has 14 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-4073 | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if t | critical | 9.8 | <=5.0.1.7 | – |
| CVE-2020-9457 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln | high | 8.8 | <=4.6.0.3 | – |
| CVE-2020-9456 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege | high | 8.8 | <=4.6.0.3 | – |
| CVE-2020-9458 | In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege | high | 8.8 | <=4.6.0.3 | – |
| CVE-2020-8435 | An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form | high | 8.1 | =4.6.0.0 | – |
| CVE-2024-10508 | The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation v | critical | 9.8 | <6.0.2.7 | 6.0.2.7 |
| CVE-2020-9455 | The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema | medium | 4.3 | <=4.6.0.3 | – |
| CVE-2020-8436 | XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter. | medium | 6.1 | =4.6.0.0 | – |
| CVE-2023-2499 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to | critical | 9.8 | <=5.2.1.0 | – |
| CVE-2020-9454 | A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a | high | 8.8 | <=4.6.0.3 | – |
| CVE-2024-1991 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privileg | high | 8.8 | <5.3.1.0 | 5.3.1.0 |
| CVE-2024-1990 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQ | high | 8.8 | <5.3.2.0 | 5.3.2.0 |
| CVE-2023-2548 | The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. Thi | medium | 6.6 | <=5.2.0.5 | – |
| CVE-2017-20208 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Obje | critical | 9.8 | <3.7.9.3 | 3.7.9.3 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked