RegistrationMagic 6.0.9.8 Cross Site Scripting

# CVE-2026-82221 - Unauthenticated Reflected XSS in RegistrationMagic
    
    ## Overview
    
    This repository contains a Proof-of-Concept (PoC) for **CVE-2026-82221**, an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in the **RegistrationMagic** WordPress plugin.
    
    The vulnerability affects the `activetab` parameter on the RegistrationMagic submissions page.
    
    An attacker can craft a malicious URL containing JavaScript and send it to a victim who has access to a RegistrationMagic submission. When the victim opens the crafted URL, attacker-controlled JavaScript is executed in the context of the vulnerable WordPress website.
    
    A relevant aspect of the vulnerability is that an attacker may be able to create the required submission on behalf of the victim if a publicly accessible RegistrationMagic form allows arbitrary email addresses to be submitted.
    
    > This repository is provided for educational and security research purposes only.
    
    ---
    
    ## Vulnerability Details
    
    | Field                   | Value                                            |
    | ----------------------- | ------------------------------------------------ |
    | CVE                     | CVE-2026-82221                                   |
    | Product                 | RegistrationMagic                                |
    | Vendor                  | Metagauss                                        |
    | Platform                | WordPress                                        |
    | Vulnerability Type      | Reflected Cross-Site Scripting (XSS)             |
    | Authentication Required | No authentication required to inject the payload |
    | Affected Versions       | RegistrationMagic <= 6.0.9.8                     |
    | Fixed Version           | RegistrationMagic 6.0.9.9                        |
    | CVSS                    | 7.1 (High)                                       |
    | Researcher              | Gabriel Tanaka                                   |
    
    ---
    
    ## Attack Requirements
    
    For successful exploitation, the victim must have a RegistrationMagic submission that can be accessed through the `/submissions/` functionality.
    
    This condition can occur in two scenarios:
    
    1. The victim has previously submitted a RegistrationMagic form and already has an accessible submission.
    
    2. A public RegistrationMagic form allows an attacker to submit a form using the victim's email address, effectively creating a submission associated with that victim.
    
    Once this prerequisite is satisfied, the attacker can send the victim a specially crafted URL containing the XSS payload.
    
    ---
    
    ## Vulnerable Parameter
    
    The vulnerable parameter is:
    
    ```text
    activetab
    ```
    
    Example vulnerable endpoint:
    
    ```text
    https://target.example/submissions/?activetab=PAYLOAD
    ```
    
    User-controlled input supplied through `activetab` is reflected into the page without sufficient output sanitization/escaping, allowing JavaScript execution.
    
    ---
    
    ## Proof of Concept
    
    A simple payload can be used to demonstrate arbitrary JavaScript execution:
    
    ```
    https://target.example/submissions/?activetab=alert(`xss`)
    ```
    ```
    https://target.example/submissions/?activetab=alert(document.cookie)
    ```
    
    <img width="1112" height="673" alt="image" src="https://github.com/user-attachments/assets/10f2a639-67c5-4aa2-a3ea-4744683bdb24" />
    <img width="806" height="439" alt="image" src="https://github.com/user-attachments/assets/3e6f1f67-9662-4c5a-bb11-a95f30cdab1f" />
    
    ## References
    
    - CVE Record  
      https://www.cve.org/CVERecord?id=CVE-2026-82221
    
    - Patchstack Vulnerability Database  
      https://patchstack.com/database/wordpress/plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
    
    - GitHub Advisory Database  
      https://github.com/advisories/GHSA-gfh3-73rq-r627
    
    - RegistrationMagic  
      https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
    
    - RegistrationMagic Changelog  
      https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers