CVE-2015-4127

NUCLEI

Church Admin < 0.800 - Cross-Site Scripting via Address Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-4127. PoCs published by woodspeed. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in the WordPress church_admin plugin version 0.800. The address field in the registration form is not properly sanitized, allowing arbitrary JavaScript execution when the Directory page is visited.

Description

Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.

Exploits (1)

exploitdb WORKING POC
by woodspeed · textwebappsphp
https://www.exploit-db.com/exploits/37112

This exploit demonstrates a stored XSS vulnerability in the WordPress church_admin plugin version 0.800. The address field in the registration form is not properly sanitized, allowing arbitrary JavaScript execution when the Directory page is visited.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress church_admin plugin v0.800
No auth needed
Prerequisites: Access to the registration form of a vulnerable WordPress site with the church_admin plugin installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress Church Admin <0.810 - Cross-Site Scripting
MEDIUMby daffainfo

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/74782
Exploit exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/37112/
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/121304

Scores

EPSS 0.0311
EPSS Percentile 87.2%

Details

CWE
CWE-79
Status published
Products (1)
church_admin_project/church_admin < 0.800
Published May 28, 2015
Tracked Since Feb 18, 2026