CVE-2024-39643: Registrationmagic Forms Stored XSS Vulnerability

CVE-2024-39643 Overview

CVE-2024-39643 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Metagauss RegistrationMagic plugin for WordPress. The flaw affects all plugin versions up to and including 6.0.0.1. Attackers can inject malicious scripts that persist in the application and execute in the browsers of users who view the affected pages. The vulnerability requires user interaction to trigger and operates across a changed security scope, enabling attackers to impact resources beyond the initially vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a victim's authenticated session, potentially leading to session hijacking, credential theft, or administrative account takeover on WordPress sites running RegistrationMagic.

Affected Products

Metagauss RegistrationMagic plugin for WordPress
All versions from unspecified initial release through 6.0.0.1
WordPress sites using RegistrationMagic for custom registration forms, user registration, payment, and user login

Discovery Timeline

2024-08-01 - CVE-2024-39643 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39643

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation within the RegistrationMagic plugin. The plugin fails to sanitize or encode input before storing it and rendering it back into HTML output. Because the payload is persisted server-side, the attack qualifies as stored XSS rather than reflected XSS. Any user who views a page containing the injected payload will execute the attacker-controlled JavaScript in their browser.

Stored XSS in a registration and form management plugin is particularly impactful because administrators routinely review submitted form data from the WordPress admin dashboard. A script executing in an administrator's session can create new admin users, modify plugin configurations, or exfiltrate authentication tokens.

Root Cause

The root cause is missing output encoding and insufficient input validation on data processed by the RegistrationMagic form handlers. User-controllable fields are written to the database without neutralizing HTML control characters such as <, >, and ". When this data is later rendered inside administrative or front-end views, the browser interprets the stored content as executable markup. This pattern is a classic violation of [CWE-79] mitigations.

Attack Vector

Exploitation occurs over the network and requires victim interaction, typically by visiting a page where the stored payload is rendered. An attacker submits a crafted payload through a RegistrationMagic form field that accepts text input. The payload is stored in the WordPress database. When an authenticated user, often an administrator, views the submission, the script executes with that user's privileges in the browser context. Because the scope changes upon exploitation, the attacker can affect data and sessions beyond the plugin itself, including other WordPress components accessible to the victim. Full technical details are available in the Patchstack XSS Vulnerability Advisory.

Detection Methods for CVE-2024-39643

Indicators of Compromise

RegistrationMagic form submissions containing HTML tags such as <script>, <img onerror=>, or <svg onload=> stored in the WordPress database
Unexpected creation of new WordPress administrator accounts following administrator review of form submissions
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting the RegistrationMagic admin pages
Modified WordPress options or plugin settings without corresponding authorized admin activity

Detection Strategies

Audit the wp_rm_* database tables for stored form submissions containing script tags or JavaScript event handlers
Enable WordPress security logging to capture administrator session activity and correlate it with form submission events
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution on admin pages
Review web server access logs for POST requests to RegistrationMagic endpoints containing URL-encoded script payloads

Monitoring Recommendations

Monitor for new administrator user creation events on WordPress sites running RegistrationMagic versions 6.0.0.1 or earlier
Alert on anomalous outbound connections from browsers of users with WordPress admin privileges
Track plugin version inventory across WordPress deployments to identify unpatched instances
Review file integrity on WordPress core and plugin directories for unauthorized modifications

How to Mitigate CVE-2024-39643

Immediate Actions Required

Update the RegistrationMagic plugin to a version later than 6.0.0.1 as soon as the vendor releases a patched release
Audit existing form submissions in the WordPress database and remove entries containing HTML or JavaScript payloads
Rotate credentials for WordPress administrator accounts that may have reviewed malicious submissions
Review the WordPress user table for unauthorized administrator accounts and remove any that are not legitimate

Patch Information

At the time of CVE publication, Metagauss had been notified through Patchstack coordinated disclosure. Administrators should consult the Patchstack XSS Vulnerability Advisory and the official Metagauss RegistrationMagic plugin page on WordPress.org for the current fixed version. Apply the patched release through the WordPress plugin updater or by manually replacing the plugin files.

Workarounds

Deactivate the RegistrationMagic plugin until a patched version is installed if the plugin is not business-critical
Restrict access to RegistrationMagic admin pages using WordPress role-based access controls and limit administrator accounts
Deploy a Web Application Firewall (WAF) with rules that block common XSS payload patterns in POST requests to WordPress form endpoints
Implement a strict Content Security Policy that disallows inline scripts in the WordPress admin interface

bash

# Example WAF rule to block script tags in RegistrationMagic form submissions
# ModSecurity rule - adjust location to match your deployment
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
    "chain,id:1003943,phase:2,deny,status:403,msg:'Potential XSS in RegistrationMagic submission'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecode,t:lowercase"