{
 "id": "WPSEC-2026-1856",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1856/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1856/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1856/index.md",
 "title": "Church Admin <= 5.1.5 - Unauthenticated Stored Cross-Site Scripting via Member Map Address and Names",
 "description": "The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via household addresses and member names shown on the member map in all versions up to, and including, 5.1.5. This is due to insufficient output escaping of those values in the map's marker data, which the map script then inserts as HTML into the marker's information window. This makes it possible for unauthenticated attackers, on sites with a public registration form, and logged-in members editing their own directory entry, to inject arbitrary web scripts that execute when a logged-in user views the member map and opens the injected marker.",
 "plugin": {
  "slug": "church-admin",
  "name": "Church Admin",
  "full_name": "Church Admin",
  "wordpress_org": "https://wordpress.org/plugins/church-admin/",
  "advisories_url": "https://wpsec.com/vuln/plugin/church-admin/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/church-admin"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.6",
 "remediation": "Update to 5.1.6 or later.",
 "fix_released": "2026-10-27T15:48:49+00:00",
 "published": "2026-10-28T16:47:31+00:00",
 "updated": "2026-10-28T09:34:07.472067+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1856/",
  "https://plugins.svn.wordpress.org/church-admin/tags/5.1.6/",
  "https://wordpress.org/plugins/church-admin/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/church-admin",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}