A stored cross‑site scripting flaw exists in the RegistrationMagic WordPress plugin, triggered through the RM_Forms shortcode when an attacker supplies a malicious value for the theme attribute. The vulnerability allows an authenticated contributor or higher to inject arbitrary JavaScript that will execute for any user who viewing the affected form page, potentially enabling a range of client‑side attacks such as credential theft, session hijacking, or defacement.

Any WordPress site installing RegistrationMagic 6.0.6.7 or earlier, including all distributions of the Plugin belonging to the metagauss vendor.

The CVSS base score is 6.4, which denotes a moderate severity; the EPSS score of less than 1% suggests a very low probability of widespread exploitation at this time. The vulnerability is not listed in CISA KEV. The exploit requires authenticated access to the WordPress site with contributor or higher privileges, and the attacker must create or edit a form that contains the malicious theme attribute; once injected, the script runs automatically for any visitor accessing that form.