# Church Admin <= 5.1.5 - Unauthenticated Stored Cross-Site Scripting via Member Map Address and Names

- **ID:** WPSEC-2026-1856
- **Plugin:** Church Admin (`church-admin`), https://wordpress.org/plugins/church-admin/
- **Affected versions:** all versions before 5.1.6
- **Fixed in:** 5.1.6 (Update to 5.1.6 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/church-admin
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1856/

## Description

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via household addresses and member names shown on the member map in all versions up to, and including, 5.1.5. This is due to insufficient output escaping of those values in the map's marker data, which the map script then inserts as HTML into the marker's information window. This makes it possible for unauthenticated attackers, on sites with a public registration form, and logged-in members editing their own directory entry, to inject arbitrary web scripts that execute when a logged-in user views the member map and opens the injected marker.

## References

- https://wpsec.com/vuln/WPSEC-2026-1856/
- https://plugins.svn.wordpress.org/church-admin/tags/5.1.6/
- https://wordpress.org/plugins/church-admin/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1856/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.