church admin project vulnerabilities

Products

• church admin 17

Latest church admin project CVEs

Newest publication first

1. CVE-2024-37440 WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability

   Published 2024-11-01

   Medium·CVSS 4.3 EPSS 0.34%

   Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

2. CVE-2024-37418 WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability

   Published 2024-07-09

   Critical·CVSS 9.9 EPSS 0.54%

   Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.

3. CVE-2024-35764 WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability

   Published 2024-06-21

   Medium·CVSS 5.4 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

4. CVE-2024-35637 WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability

   Published 2024-06-03

   Medium·CVSS 4.4 EPSS 0.24%

   Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.

5. CVE-2024-31281 WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability

   Published 2024-05-17

   Medium·CVSS 6.3 EPSS 0.34%

   Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.

6. CVE-2024-34828 WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-05-10

   Medium·CVSS 4.3 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.

7. CVE-2024-32090 WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-04-15

   Medium·CVSS 4.3 EPSS 0.21%

   Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

8. CVE-2024-31280 WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability

   Published 2024-04-07

   High·CVSS 8.8 EPSS 0.63%

   Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.

9. CVE-2024-30505 WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability

   Published 2024-03-29

   Medium·CVSS 5.4 EPSS 0.47%

   Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

10. CVE-2024-30493 WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-03-29

    Medium·CVSS 4.3 EPSS 0.21%

    Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.

11. CVE-2024-30244 WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability

    Published 2024-03-28

    High·CVSS 8.8 EPSS 0.66%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

12. CVE-2024-30193 WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability

    Published 2024-03-27

    Medium·CVSS 5.4 EPSS 0.32%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.

13. CVE-2024-30197 WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability

    Published 2024-03-27

    Medium·CVSS 5.4 EPSS 0.32%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.

14. CVE-2023-38515 WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)

    Published 2023-11-13

    Medium·CVSS 4.9 EPSS 0.51%

    Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.

15. CVE-2023-34021 WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-06-23

    Medium·CVSS 6.1 EPSS 0.38%

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.

16. CVE-2022-0833 Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure

    Published 2022-03-28

    Medium·CVSS 4.3 EPSS 0.49%

    The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible t...

17. CVE-2015-4127 Church Admin < 0.810 - Stored Cross-Site Scripting

    Published 2015-05-28

    Medium·CVSS 4.3 EPSS 7.4% Public exploit

    Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.