Vulnerabilities / Sermon Browser
Sermon Browser vulnerabilities
Advisories WPSec published for Sermon Browser. Other sources may list more. Its attack surface: Sermon Browser on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-17 | WPSEC-2026-1180 | Sermon Browser <= 0.45.22 - Unauthenticated Open Redirect via 'url' Parameter | Medium 6.1 | 0.46.0 |
| 2026-10-17 | WPSEC-2026-1179 | Sermon Browser <= 0.45.22 - Unauthenticated Stored Cross-Site Scripting via Preacher, Series and Service Names | High 7.2 | 0.46.0 |
| 2026-10-17 | WPSEC-2026-1178 | Sermon Browser <= 0.45.22 - Missing Authorization to Unauthenticated Preacher, Series, Service and File Modification | High 7.3 | 0.46.0 |
| 2026-10-17 | WPSEC-2026-1177 | Sermon Browser <= 0.45.22 - Authenticated (Author+) Stored Cross-Site Scripting via Embed Code | Medium 6.4 | 0.46.0 |
| 2026-10-17 | WPSEC-2026-1176 | Sermon Browser <= 0.45.22 - Authenticated (Author+) Server-Side Request Forgery via Remote File Import | Medium 6.4 | 0.46.0 |
License: CC BY 4.0