sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total30
Critical4
High6
Medium19
Reset
Showing 1-20 of 30 records
Threat Entry Updated 2026-11-07

Church Admin - Security Vulnerability (CVE-2026-123418)

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present.

PLUGIN Church Admin

CVE-2026-123418

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Church Admin - Security Vulnerability (CVE-2026-94421)

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Church Admin

CVE-2026-94421

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Church Admin - Server-Side Request Forgery (SSRF) (CVE-2026-0682)

The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Church Admin

CVE-2026-0682

LOW CVSS 2.2 2026-01-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Church Admin - SQL Injection (CVE-2025-26941)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through

PLUGIN Church Admin

CVE-2025-26941

CRITICAL CVSS 9.3 2025-03-26
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.