Plugin icon

Church Admin

church-admin

Vulnerabilities:

28

Last Updated:

March 19, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2026-01-16
Title
Church Admin < 5.0.29 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
Fixed in
Fixed in 5.0.29
CVSS
2.2 (low)
Published
2025-08-22
Title
Church Admin < 5.0.27 - Missing Authorization
Fixed in
Fixed in 5.0.27
CVSS
5.3 (medium)
Published
2025-04-16
Title
Church Admin < 5.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.0.24
CVSS
6.4 (medium)
Published
2025-04-16
Title
Church Admin < 5.0.10 - Unauthenticated Information Disclosure
Fixed in
Fixed in 5.0.10
CVSS
5.3 (medium)
Published
2025-03-13
Title
Church Admin < 5.0.19 - Unauthenticated SQL Injection
Fixed in
Fixed in 5.0.19
CVSS
7.5 (high)
Published
2024-12-02
Title
Church Admin < 5.0.9 - Missing Authorization
Fixed in
Fixed in 5.0.9
CVSS
5.3 (medium)
Published
2024-10-24
Title
Church Admin < 5.0.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.0.0
CVSS
6.1 (medium)
Published
2024-07-04
Title
Church Admin < 4.4.7 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 4.4.7
CVSS
8.8 (high)
Published
2024-06-28
Title
Church Admin < 4.4.5 - Missing Authorization
Fixed in
Fixed in 4.4.5
CVSS
5.3 (medium)
Published
2024-06-17
Title
Church Admin < 4.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.5
CVSS
6.4 (medium)
Published
2024-05-30
Title
Church Admin < 4.4.0 - Authenticated (Admin+) Server-Side Request Forgery
Fixed in
Fixed in 4.4.0
CVSS
5.5 (medium)
Published
2024-05-09
Title
Church Admin < 4.2.0 - Cross-Site Request Forgery
Fixed in
Fixed in 4.2.0
CVSS
4.3 (medium)
Published
2024-04-11
Title
Church Admin < 4.0.28 - Cross-Site Request Forgery
Fixed in
Fixed in 4.0.28
CVSS
4.3 (medium)
Published
2024-04-05
Title
Church Admin < 4.1.6 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 4.1.6
CVSS
8.8 (high)
Published
2024-04-05
Title
Church Admin < 4.1.7 - Missing Authorization
Fixed in
Fixed in 4.1.7
CVSS
4.3 (medium)
Published
2024-03-28
Title
Church Admin < 4.1.8 - Cross-Site Request Forgery
Fixed in
Fixed in 4.1.8
CVSS
4.3 (medium)
Published
2024-03-28
Title
Church Admin < 4.1.19 - Missing Authorization
Fixed in
Fixed in 4.1.19
CVSS
4.3 (medium)
Published
2024-03-26
Title
Church Admin < 4.0.28 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 4.0.28
CVSS
8.8 (high)
Published
2024-03-25
Title
Church Admin < 4.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Fixed in
Fixed in 4.0.27
CVSS
6.4 (medium)
Published
2024-03-25
Title
Church Admin < 4.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text
Fixed in
Fixed in 4.1.18
CVSS
6.4 (medium)
Published
2023-11-13
Title
Church Admin < 3.8.0 - Server-Side Request Forgery (SSRF)
Fixed in
Fixed in 3.8.0
CVSS
5.5 (medium)
Published
2023-08-16
Title
Church Admin < 3.7.6 - Reflected XSS
Fixed in
Fixed in 3.7.6
CVSS
7.1 (high)
Published
2023-06-13
Title
Church Admin < 3.7.30 - Reflected XSS
Fixed in
Fixed in 3.7.30
CVSS
7.1 (high)
Published
2022-03-07
Title
Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure
Fixed in
Fixed in 3.4.135
CVSS
7.5 (high)
Published
2018-02-14
Title
Church Admin < 1.2550 - CSRF
Fixed in
Fixed in 1.2550
CVSS
8.8 (high)
Published
2017-12-28
Title
Church Admin 0.33.2.1 - Unauthenticated Directory Traversal
Fixed in
Fixed in 0.565
CVSS
n/a
Published
2015-05-19
Title
Church Admin < 0.810 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 0.810
CVSS
n/a
Published
2014-08-01
Title
Church Admin <= 0.4.2 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 0.4.3
CVSS
n/a