Threats tagged 'ghsa-g46f-hh66-fqc2'

The Church Admin plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'lat' parameter in all versions up to and including 5.1.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user views the affected page. Exploitation requires that a Google Maps API key be configured in the plugin settings, as the vulnerable code path is only triggered under this condition.