Church Admin

church-admin · plugin

Known security vulnerabilities for Church Admin. Find out in seconds which version runs on your site with WP Lens.

27 known vulnerabilities

3 critical · 13 exploitable without logging in · 1 with public exploit code · latest Aug 13, 2026

Listed on wordpress.org · latest 5.1.4 · last updated Sep 28, 2026 · 900+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2024-37418login required≤ 4.4.6
WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability
Critical 9.9
CVE-2026-66478unauthenticated≤ 5.1.1
WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability
Critical 9.3
CVE-2025-26941unauthenticated≤ 5.0.18
WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability
Critical 9.3
CVE-2018-20971unauthenticated · needs a click
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
High 8.8
CVE-2024-31280login required≤ 4.1.5
WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability
High 8.8
CVE-2024-30244login required≤ 4.0.27
WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability
High 8.8
CVE-2024-30505unauthenticated≤ 4.1.18
WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability
Medium 6.5
CVE-2025-39555login required≤ 5.0.23
WordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2024-31281login required≤ 4.1.6
WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability
Medium 6.3
CVE-2024-50438unauthenticated · needs a click≤ 5.0.0
WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Medium 6.1
CVE-2023-30782unauthenticated · needs a click≤ 3.7.5
WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS)
Medium 6.1
CVE-2023-34021unauthenticated · needs a click≤ 3.7.29
WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)
Medium 6.1
CVE-2024-35764login required≤ 4.4.4
WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-30197login required≤ 4.0.26
WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2024-30193login required≤ 4.1.17
WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2026-61983unauthenticated≤ 5.0.30
WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability
Medium 5.3
CVE-2025-57896unauthenticated≤ 5.0.26
WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability
Medium 5.3
CVE-2024-53795unauthenticated≤ 5.0.8
WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerability
Medium 5.3
CVE-2023-38515high privilege≤ 3.7.56
WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)
Medium 4.9
CVE-2024-35637high privilege≤ 4.3.6
WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability
Medium 4.4
CVE-2024-34828unauthenticated · needs a click≤ 4.1.32
WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2024-32090unauthenticated · needs a click≤ 4.0.27
WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2024-30493unauthenticated · needs a click≤ 4.1.7
WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2025-39553login required≤ 5.0.9
WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability
Medium 4.3
CVE-2024-37440login required≤ 4.4.4
WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability
Medium 4.3
CVE-2015-4127
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary w
Medium 4.3
CVE-2026-0682admin≤ 5.0.28
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
Low 2.2

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory