VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Church Admin security & vulnerabilities

church-admin— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
30Known vulnerabilities
  • Critical0
  • High7
  • Medium22
  • Low1
Vulnerabilities per year
2015: 1 vulnerability1152018: 1 vulnerability1182022: 1 vulnerability1222023: 3 vulnerabilities3232024: 15 vulnerabilities15242025: 4 vulnerabilities4252026: 5 vulnerabilities526

All Church Admin vulnerabilities

Church Admin vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter
≤5.1.7Update to 5.1.8
CVE-2026-123418
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
≤5.1.2Update to 5.1.3
CVE-2026-94421
High7.5Unauthenticated SQL Injection
≤5.1.1Update to 5.1.2
CVE-2026-66478
Medium4.3Missing Authorization
≤5.0.30Update to 5.1.0
CVE-2026-61983
Low2.2Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
≤5.0.28Update to 5.0.29
CVE-2026-0682
Medium5.3Missing Authorization
≤5.0.26Update to 5.0.27
CVE-2025-57896
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.0.23Update to 5.0.24
CVE-2025-39555
Medium5.3Unauthenticated Information Disclosure
≤5.0.9Update to 5.0.10
CVE-2025-39553
High7.5Unauthenticated SQL Injection
≤5.0.18Update to 5.0.19
CVE-2025-26941
Medium5.3Missing Authorization
≤5.0.8Update to 5.0.9
CVE-2024-53795
Medium6.1Reflected Cross-Site Scripting
<5.0.0Update to 5.0.0
CVE-2024-50438
High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤4.4.6Update to 4.4.7
CVE-2024-37418
Medium5.3Missing Authorization
≤4.4.4Update to 4.4.5
CVE-2024-37440
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.4.4Update to 4.4.5
CVE-2024-35764
Medium5.5Authenticated (Admin+) Server-Side Request Forgery
≤4.3.6Update to 4.4.0
CVE-2024-35637
Medium4.3Cross-Site Request Forgery
≤4.1.32Update to 4.2.0
CVE-2024-34828
Medium4.3Cross-Site Request Forgery
≤4.0.27Update to 4.0.28
CVE-2024-32090
High8.8 Authenticated (Subscriber+) Arbitrary File Upload
≤4.1.5Update to 4.1.6
CVE-2024-31280
Medium4.3Missing Authorization
≤4.1.6Update to 4.1.7
CVE-2024-31281
Medium4.3Missing Authorization
≤4.1.18Update to 4.1.19
CVE-2024-30505
Medium4.3Cross-Site Request Forgery
≤4.1.7Update to 4.1.8
CVE-2024-30493
High8.8Authenticated (Contributor+) SQL Injection
≤4.0.27Update to 4.0.28
CVE-2024-30244
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
≤4.0.26Update to 4.0.27
CVE-2024-30197
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text
≤4.1.17Update to 4.1.18
CVE-2024-30193
Medium5.5Server-Side Request Forgery via church_admin_import_csv
≤3.7.56Update to 3.8.0
CVE-2023-38515
Medium6.1Reflected Cross-Site Scripting
≤3.7.29Update to 3.7.30
CVE-2023-34021
Medium6.1Reflected Cross-Site Scripting
≤3.7.5Update to 3.7.6
CVE-2023-30782
Medium4.3Cross-Site Request Forgery leading to Plugin Backup Disclosure
<3.4.135Update to 3.4.135
CVE-2022-0833
High8.8Cross-Site Request Forgery
<1.2550Update to 1.2550
CVE-2018-20971
Medium6.1Stored Cross-Site Scripting
<0.810Update to 0.810
CVE-2015-4127

Church Admin: common questions

Does Church Admin have known vulnerabilities?

Yes. VulnCrest Radar lists 30 known vulnerabilities in Church Admin: 7 high, 22 medium, 1 low. None are known to affect version null.

How do I check which version of Church Admin I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Church Admin vulnerability?

CVE-2026-123418, published Nov 6, 2026: Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter. Severity: High (CVSS 7.2).

Is any Church Admin vulnerability listed in CISA KEV?

No. None of the known Church Admin vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?