Church Admin <= 5.1.5 - Unauthenticated Stored Cross-Site Scripting via Member Map Address and Names
- ID
- WPSEC-2026-1856
- Plugin
- Church Admin (church-admin)
- Affected
- all versions before 5.1.6
- Remediation
- Update to 5.1.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- Church Admin on WPSec AttackSurface
- Fix released
- Published
Description
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via household addresses and member names shown on the member map in all versions up to, and including, 5.1.5. This is due to insufficient output escaping of those values in the map's marker data, which the map script then inserts as HTML into the marker's information window. This makes it possible for unauthenticated attackers, on sites with a public registration form, and logged-in members editing their own directory entry, to inject arbitrary web scripts that execute when a logged-in user views the member map and opens the injected marker.
References
- https://wpsec.com/vuln/WPSEC-2026-1856/
- https://plugins.svn.wordpress.org/church-admin/tags/5.1.6/
- https://wordpress.org/plugins/church-admin/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS