Vulnerabilities and security researches forchurch-admin church-admin

Direction: descending

Aug 15, 2026

Church Admin # CVE-2026-66478

CVE, Research URL: CVE-2026-66478
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Aug 13, 2026
Research Description: Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
Affected versions: max 5.1.2.
Status: vulnerable

Jul 16, 2026

Church Admin # CVE-2026-61983

CVE, Research URL: CVE-2026-61983
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jul 13, 2026
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.
Affected versions: max 5.0.30.
Status: vulnerable

Jun 16, 2026

Church Admin # 02d4e46f8d1571ae60508144443acb367dbc42ee

CVE, Research URL: 02d4e46f8d1571ae60508144443acb367dbc42ee
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Aug 01, 2014
Research Description: Church Admin [church-admin] < 0.33.4.6 WordPress Church Admin Plugin <= 0.33.4.5 - Cross Site Scripting This plugin is prone to a cross site scripting vulnerability in includes/validate.php id parameter. Update the plugin.
Affected versions: max 0.33.4.6.
Status: vulnerable

Church Admin # 5847628d-0607-4921-b97c-0463f1346a48

CVE, Research URL: 5847628d-0607-4921-b97c-0463f1346a48
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: -
Research Description: Church Admin [church-admin] < 0.565 Church Admin 0.33.2.1 - Unauthenticated Directory Traversal The "key" parameter of download.php from plugins/church-admin/display/download.php is not sanitized and is vulnerable to a directory traversal type of attack.
Affected versions: max 0.565.
Status: vulnerable

Church Admin # f573ca10-6a07-401a-b98b-85bfa328fab2

CVE, Research URL: f573ca10-6a07-401a-b98b-85bfa328fab2
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: -
Research Description: Church Admin [church-admin] < 0.4.3 Church Admin <= 0.4.2 - Cross-Site Scripting (XSS) The Church Admin WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Affected versions: max 0.4.3.
Status: vulnerable

Church Admin # 8f760398227dcc9584cb74c875c7848453372a46

CVE, Research URL: 8f760398227dcc9584cb74c875c7848453372a46
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jul 06, 2012
Research Description: Church Admin [church-admin] < 0.33.4.6 WordPress Church Admin Plugin - Cross Site Scripting WordPress Church_Admin plugin's "id" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials. Other attacks are also possible. Update the plugin.
Affected versions: max 0.33.4.6.
Status: vulnerable

Church Admin # af7a78cdab0b5b975cebde04c3bbbe0b01665875

CVE, Research URL: af7a78cdab0b5b975cebde04c3bbbe0b01665875
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jan 10, 2018
Research Description: Church Admin [church-admin] < 0.565 WordPress Church Admin plugin <=0.564 - Unauthenticated Directory Traversal vulnerability Unauthenticated Directory Traversal vulnerability found in WordPress Church Admin plugin (versions <=0.564).
Affected versions: max 0.565.
Status: vulnerable

Apr 16, 2026

Church Admin # CVE-2026-0682

CVE, Research URL: CVE-2026-0682
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jan 17, 2026
Research Description: The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected versions: max 5.0.29.
Status: vulnerable

Aug 24, 2025

Church Admin # CVE-2025-57896

CVE, Research URL: CVE-2025-57896
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Aug 22, 2025
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26.
Affected versions: max 5.0.27.
Status: vulnerable

Apr 29, 2025

Church Admin # CVE-2025-39553

CVE, Research URL: CVE-2025-39553
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Sep 09, 2025
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
Affected versions: max 5.0.10.
Status: vulnerable

Apr 18, 2025

Church Admin # CVE-2025-39555

CVE, Research URL: CVE-2025-39555
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Apr 16, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23.
Affected versions: max 5.0.24.
Status: vulnerable

Mar 28, 2025

Church Admin # CVE-2025-26941

CVE, Research URL: CVE-2025-26941
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 26, 2025
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18.
Affected versions: max 5.0.19.
Status: vulnerable

Dec 08, 2024

Church Admin # CVE-2024-53795

CVE, Research URL: CVE-2024-53795
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Dec 06, 2024
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through <= 5.0.8.
Affected versions: max 5.0.9.
Status: vulnerable

Oct 28, 2024

Church Admin # CVE-2024-50438

CVE, Research URL: CVE-2024-50438
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Oct 28, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0.
Affected versions: max 5.0.0.
Status: vulnerable

Jul 08, 2024

Church Admin # CVE-2024-37418

CVE, Research URL: CVE-2024-37418
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jul 09, 2024
Research Description: Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
Affected versions: max 4.4.7.
Status: vulnerable

Jul 02, 2024

Church Admin # CVE-2024-37440

CVE, Research URL: CVE-2024-37440
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.
Affected versions: max 4.4.5.
Status: vulnerable

Jun 20, 2024

Church Admin # CVE-2024-35764

CVE, Research URL: CVE-2024-35764
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jun 21, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.
Affected versions: max 4.4.5.
Status: vulnerable

Jun 06, 2024

Church Admin # CVE-2023-34021

CVE, Research URL: CVE-2023-34021
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jun 23, 2023
Research Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.
Affected versions: max 3.7.30.
Status: vulnerable

Church Admin # CVE-2018-20971

CVE, Research URL: CVE-2018-20971
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Aug 17, 2019
Research Description: The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Affected versions: max 1.2550.
Status: vulnerable

Church Admin # CVE-2015-4127

CVE, Research URL: CVE-2015-4127
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: May 28, 2015
Research Description: Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
Affected versions: max 0.810.
Status: vulnerable

Church Admin # CVE-2023-38515

CVE, Research URL: CVE-2023-38515
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Nov 13, 2023
Research Description: Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.
Affected versions: max 3.8.0.
Status: vulnerable

Church Admin # CVE-2024-30197

CVE, Research URL: CVE-2024-30197
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.
Affected versions: max 4.0.27.
Status: vulnerable

Church Admin # CVE-2024-30505

CVE, Research URL: CVE-2024-30505
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 29, 2024
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.
Affected versions: max 4.1.19.
Status: vulnerable

Church Admin # CVE-2024-30493

CVE, Research URL: CVE-2024-30493
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 29, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.
Affected versions: max 4.1.8.
Status: vulnerable

Church Admin # CVE-2023-30782

CVE, Research URL: CVE-2023-30782
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Aug 16, 2023
Research Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions.
Affected versions: max 3.7.6.
Status: vulnerable

Church Admin # CVE-2022-0833

CVE, Research URL: CVE-2022-0833
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 28, 2022
Research Description: The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
Affected versions: max 3.4.135.
Status: vulnerable

Church Admin # CVE-2024-30244

CVE, Research URL: CVE-2024-30244
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 28, 2024
Research Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.
Affected versions: max 4.0.28.
Status: vulnerable

Church Admin # CVE-2024-31280

CVE, Research URL: CVE-2024-31280
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Apr 07, 2024
Research Description: Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.
Affected versions: max 4.1.6.
Status: vulnerable

Church Admin # CVE-2024-30193

CVE, Research URL: CVE-2024-30193
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Mar 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.
Affected versions: max 4.1.18.
Status: vulnerable

Church Admin # CVE-2024-32090

CVE, Research URL: CVE-2024-32090
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Apr 15, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.
Affected versions: max 4.0.28.
Status: vulnerable

Church Admin # CVE-2024-31281

CVE, Research URL: CVE-2024-31281
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: May 17, 2024
Research Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.
Affected versions: max 4.1.7.
Status: vulnerable

Church Admin # CVE-2024-34828

CVE, Research URL: CVE-2024-34828
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: May 14, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.
Affected versions: max 4.2.0.
Status: vulnerable

Church Admin # CVE-2024-35637

CVE, Research URL: CVE-2024-35637
Home page URL: Security reports for Church Admin
Application: Church Admin
Date: Jun 03, 2024
Research Description: Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.
Affected versions: max 4.4.0.
Status: vulnerable