The vulnerability arises because the Payment Method field of the RegistrationMagic plugin is not properly sanitized before being stored and later displayed. This allows an authenticated user with Subscriber access or higher to inject arbitrary JavaScript that is executed whenever any visitor loads the affected page. The impact includes hijacking user sessions, defacing pages, or injecting phishing content without the need for additional stealth or exploitation of other vulnerabilities.

WordPress sites that have installed the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin, in any version up to and including 6.0.4.3, are susceptible. The issue is tied to the plugin’s handling of the payment_method parameter.

The CVSS score of 6.4 rates this as a medium severity flaw, while an EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploit. Attacks would require an authenticated subscriber or higher, who could inject malicious scripts via the payment_method field, leading to stored XSS that executes for all users who subsequently view the form page.