ByteOS

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.18% / 7.37%

||

7 Day CHG~0.00%

Published-13 Jul, 2026 | 08:41

Updated-13 Jul, 2026 | 16:57

WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-862

Missing Authorization

CVE-2026-0682

Assigner-Wordfence

Assigner-Wordfence

CVSS Score-2.2||LOW

EPSS-0.24% / 15.82%

||

7 Day CHG~0.00%

Published-17 Jan, 2026 | 03:24

Updated-08 Apr, 2026 | 17:01

Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter

The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2025-57942

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 5.88%

||

7 Day CHG~0.00%

Published-22 Sep, 2025 | 18:24

Updated-12 May, 2026 | 00:52

WordPress Emergency Password Reset plugin <= 9.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through <= 9.3.

Vendor-andy_moyle

Product-Emergency Password Reset

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2025-39553

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.23% / 14.42%

||

7 Day CHG~0.00%

Published-09 Sep, 2025 | 16:25

Updated-28 Apr, 2026 | 16:12

WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-862

Missing Authorization

CVE-2025-57896

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.22% / 13.19%

||

7 Day CHG+0.01%

Published-22 Aug, 2025 | 12:00

Updated-28 Apr, 2026 | 16:13

WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-862

Missing Authorization

CVE-2025-39555

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.61%

||

7 Day CHG~0.00%

Published-16 Apr, 2025 | 12:44

Updated-28 Apr, 2026 | 16:12

WordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-26941

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-9.3||CRITICAL

EPSS-0.57% / 43.89%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:40

Updated-28 Apr, 2026 | 16:11

WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18.

Vendor-andy_moyle

Product-Church Admin

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2024-53795

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.53% / 41.59%

||

7 Day CHG~0.00%

Published-06 Dec, 2024 | 13:07

Updated-28 Apr, 2026 | 16:10

WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through <= 5.0.8.

Vendor-andy_moyle churchadminplugin

Product-Church Admin church_admin

CWE ID-CWE-862

Missing Authorization

CVE-2024-37440

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 25.67%

||

7 Day CHG~0.00%

Published-01 Nov, 2024 | 14:18

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

CWE ID-CWE-862

Missing Authorization

CVE-2024-50438

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.30% / 22.22%

||

7 Day CHG~0.00%

Published-28 Oct, 2024 | 18:07

Updated-11 May, 2026 | 21:23

WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0.

Vendor-themoyles andy_moyle

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-37418

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-9.9||CRITICAL

EPSS-0.54% / 42.05%

||

7 Day CHG~0.00%

Published-09 Jul, 2024 | 10:15

Updated-29 Apr, 2026 | 10:16

WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.

Vendor-church_admin_project andy_moyle andymoyle

Product-church_admin Church Admin church_admin

CWE ID-CWE-434

Unrestricted Upload of File with Dangerous Type

CVE-2024-35764

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.24%

||

7 Day CHG~0.00%

Published-21 Jun, 2024 | 12:33

Updated-11 May, 2026 | 21:03

WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-35637

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.4||MEDIUM

EPSS-0.24% / 15.73%

||

7 Day CHG~0.00%

Published-03 Jun, 2024 | 08:59

Updated-11 May, 2026 | 21:01

WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.

CWE ID-CWE-918

Server-Side Request Forgery (SSRF)

CVE-2024-31281

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-6.3||MEDIUM

EPSS-0.34% / 26.76%

||

7 Day CHG~0.00%

Published-17 May, 2024 | 08:54

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.

CWE ID-CWE-862

Missing Authorization

CVE-2024-34828

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 16.77%

||

7 Day CHG~0.00%

Published-10 May, 2024 | 08:16

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2024-32090

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 12.17%

||

7 Day CHG~0.00%

Published-15 Apr, 2024 | 09:02

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2024-31280

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-9.9||CRITICAL

EPSS-0.62% / 46.33%

||

7 Day CHG~0.00%

Published-07 Apr, 2024 | 17:33

Updated-29 Apr, 2026 | 10:16

WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.

Vendor-church_admin_project andy_moyle andymoyle

Product-church_admin Church Admin church_admin

CWE ID-CWE-434

Unrestricted Upload of File with Dangerous Type

CVE-2024-30505

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-5.4||MEDIUM

EPSS-0.47% / 37.96%

||

7 Day CHG~0.00%

Published-29 Mar, 2024 | 14:12

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

CWE ID-CWE-862

Missing Authorization

CVE-2024-30493

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.21% / 11.94%

||

7 Day CHG~0.00%

Published-29 Mar, 2024 | 13:51

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2024-30244

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-8.5||HIGH

EPSS-0.66% / 47.78%

||

7 Day CHG~0.00%

Published-28 Mar, 2024 | 04:20

Updated-11 May, 2026 | 20:58

WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2024-30193

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.37%

||

7 Day CHG~0.00%

Published-27 Mar, 2024 | 06:41

Updated-28 Apr, 2026 | 16:09

WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-30197

Assigner-Patchstack

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.37%

||

7 Day CHG~0.00%

Published-27 Mar, 2024 | 06:26

Updated-11 May, 2026 | 20:56

WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.