Advisories · Technology

andy_moyle Church Admin.

Every CVE that names andy_moyle Church Admin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-123418 CVE record

CVSS 7.2 High

Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 7 Nov 2026
CVE-2026-94421 CVE record

CVSS 6.4 Medium

Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-66478 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability
- andy_moyle Church Admin
- SQL injection
Not analysed yet 13 Aug 2026
CVE-2026-61983 CVE record

CVSS 5.3 Medium

WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 13 Jul 2026
CVE-2026-0682 CVE record

CVSS 2.2 Low

Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
- andy_moyle Church Admin
- Server-side request forgery (SSRF)
Not analysed yet 17 Jan 2026
CVE-2025-39553 CVE record

CVSS 4.3 Medium

WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-57896 CVE record

CVSS 5.3 Medium

WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 22 Aug 2025
CVE-2025-39555 CVE record

CVSS 6.5 Medium

WordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerability
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 16 Apr 2025
CVE-2025-26941 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability
- andy_moyle Church Admin
- SQL injection
Not analysed yet 26 Mar 2025
CVE-2024-53795 CVE record

CVSS 5.3 Medium

WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 6 Dec 2024
CVE-2024-37440 CVE record

CVSS 4.3 Medium

WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 1 Nov 2024
CVE-2024-50438 CVE record

CVSS 7.1 High

WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 28 Oct 2024
CVE-2024-37418 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability
- andy_moyle Church Admin
- Unrestricted file upload
Not analysed yet 9 Jul 2024
CVE-2024-35764 CVE record

CVSS 6.5 Medium

WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 21 Jun 2024
CVE-2024-35637 CVE record

CVSS 4.4 Medium

WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability
- andy_moyle Church Admin
- Server-side request forgery (SSRF)
Not analysed yet 3 Jun 2024
CVE-2024-31281 CVE record

CVSS 6.3 Medium

WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 17 May 2024
CVE-2024-34828 CVE record

CVSS 4.3 Medium

WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability
- andy_moyle Church Admin
- Cross-site request forgery (CSRF)
Not analysed yet 10 May 2024
CVE-2024-32090 CVE record

CVSS 4.3 Medium

WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability
- andy_moyle Church Admin
- Cross-site request forgery (CSRF)
Not analysed yet 15 Apr 2024
CVE-2024-31280 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability
- andy_moyle Church Admin
- Unrestricted file upload
Not analysed yet 7 Apr 2024
CVE-2024-30505 CVE record

CVSS 5.4 Medium

WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability
- andy_moyle Church Admin
- Broken access control
Not analysed yet 29 Mar 2024
CVE-2024-30493 CVE record

CVSS 4.3 Medium

WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability
- andy_moyle Church Admin
- Cross-site request forgery (CSRF)
Not analysed yet 29 Mar 2024
CVE-2024-30244 CVE record

CVSS 8.5 High

WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability
- andy_moyle Church Admin
- SQL injection
Not analysed yet 28 Mar 2024
CVE-2024-30193 CVE record

CVSS 6.5 Medium

WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2024
CVE-2024-30197 CVE record

CVSS 6.5 Medium

WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability
- andy_moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2024
CVE-2023-38515 CVE record

CVSS 5.5 Medium

WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)
- Andy Moyle Church Admin
- Server-side request forgery (SSRF)
Not analysed yet 13 Nov 2023
CVE-2023-30782 CVE record

CVSS 7.1 High

WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS)
- Andy Moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2023
CVE-2023-34021 CVE record

CVSS 7.1 High

WordPress Church Admin Plugin <= 3.7.29 is vulnerable to Cross Site Scripting (XSS)
- Andy Moyle Church Admin
- Cross-site scripting (XSS)
Not analysed yet 23 Jun 2023