andy_moyle Vulnerabilities and Affected Products

Products

Church Admin22 vulnerabilities
Emergency Password Reset1 vulnerability

andy_moyle vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-66478CRITICAL	WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. CWE-89Aug 13, 2026	CVSS9.3v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-61983MEDIUM	WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30. CWE-862Jul 13, 2026	CVSS5.3v3.1	EPSS0.176%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-0682LOW	Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CWE-918Jan 17, 2026	CVSS2.2v3.1	EPSS0.245%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-39553MEDIUM	WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9. CWE-862Sep 9, 2025	CVSS4.3v3.1	EPSS0.251%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-57896MEDIUM	WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26. CWE-862Aug 22, 2025	CVSS5.3v3.1	EPSS0.224%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-39555MEDIUM	WordPress Church Admin plugin <= 5.0.23 - Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23. CWE-79Apr 16, 2025	CVSS6.5v3.1	EPSS0.331%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-26941CRITICAL	WordPress Church Admin plugin <= 5.0.18 - SQL Injection vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18. CWE-89Mar 26, 2025	CVSS9.3v3.1	EPSS0.573%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-53795MEDIUM	WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through <= 5.0.8. CWE-862Dec 6, 2024	CVSS5.3v3.1	EPSS0.529%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-37440MEDIUM	WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4. CWE-862Nov 1, 2024	CVSS4.3v3.1	EPSS0.341%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-50438HIGH	WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0. CWE-79Oct 28, 2024	CVSS7.1v3.1	EPSS0.308%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-37418CRITICAL	WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6. CWE-434Jul 9, 2024	CVSS9.9v3.1	EPSS0.537%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-35764MEDIUM	WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4. CWE-79Jun 21, 2024	CVSS6.5v3.1	EPSS0.319%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-35637MEDIUM	WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6. CWE-918Jun 3, 2024	CVSS4.4v3.1	EPSS0.244%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-31281MEDIUM	WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6. CWE-862May 17, 2024	CVSS6.3v3.1	EPSS0.342%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-34828MEDIUM	WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32. CWE-352May 10, 2024	CVSS4.3v3.1	EPSS0.253%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-32090MEDIUM	WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27. CWE-352Apr 15, 2024	CVSS4.3v3.1	EPSS0.216%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-31280CRITICAL	WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5. CWE-434Apr 7, 2024	CVSS9.9v3.1	EPSS0.625%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-30505MEDIUM	WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18. CWE-862Mar 29, 2024	CVSS5.4v3.1	EPSS0.468%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-30493MEDIUM	WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7. CWE-352Mar 29, 2024	CVSS4.3v3.1	EPSS0.214%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-30244HIGH	WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27. CWE-89Mar 28, 2024	CVSS8.5v3.1	EPSS0.659%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-30193MEDIUM	WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17. CWE-79Mar 27, 2024	CVSS6.5v3.1	EPSS0.32%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-30197MEDIUM	WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26. CWE-79Mar 27, 2024	CVSS6.5v3.1	EPSS0.32%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX