Andy Moyle vulnerabilities and threats

26 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.2		CVE-2026-123418Church Admin (WordPress plugin) · Cross-site Scripting High7.22026-11-07CVE Database V5CVE-2026-123418 The Church Admin WordPress plugin up to version 5.1.7 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'lat' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that a Google Maps API key be configured in the plugin settings, as the vulnerable code path is only triggered in this scenario. Vulnerability andy_moyle CWE-79	CVE Database V5	2026-11-07
Medium	6.4	EPSS 0.2%	CVE-2026-94421Church Admin (WordPress plugin) · Cross-site Scripting Medium6.4EPSS 0.2%2026-10-10CVE Database V5CVE-2026-94421 The Church Admin WordPress plugin up to version 5.1.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'email' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping. EPSS 0.2%Vulnerability andy_moyle CWE-79 #ghsa-jgmr-w25q-m9q5	CVE Database V5	2026-10-10
Critical	9.3	EPSS 0.4%	CVE-2026-66478Church Admin (WordPress plugin) · SQL Injection Critical9.3EPSS 0.4%2026-08-13CVE Database V5CVE-2026-66478 Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. EPSS 0.4%Vulnerability andy_moyle CWE-89 #ghsa-qc76-7cx7-6pgf	CVE Database V5	2026-08-13
Medium	5.3	EPSS 0.3%	CVE-2026-61983Church Admin (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-07-13CVE Database V5CVE-2026-61983 Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30. EPSS 0.3%Vulnerability andy_moyle CWE-862	CVE Database V5	2026-07-13
Medium	4.3	EPSS 0.1%	CVE-2024-35648Emergency Password Reset (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.1%2026-06-17CVE Database V5CVE-2024-35648 CVE-2024-35648 is a Cross-Site Request Forgery (CSRF) vulnerability in the Andy Moyle Emergency Password Reset product affecting versions up to and including 8.0. This vulnerability allows an attacker to trick an authenticated user into submitting a forged request, potentially leading to unauthorized actions. The CVSS score is 4.3, indicating a medium severity level. No official patch or remediation has been confirmed at this time. EPSS 0.1%Vulnerability Andy Moyle CWE-352	CVE Database V5	2026-06-17
Low	2.2	EPSS 0.3%	CVE-2026-0682Church Admin (WordPress plugin) · Server-Side Request Forgery (SSRF) Low2.2EPSS 0.3%2026-01-17CVE Database V5CVE-2026-0682 The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.28 due to insufficient validation of user-supplied URLs in the 'audio_url' parameter. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. EPSS 0.3%Vulnerability andy_moyle CWE-918	CVE Database V5	2026-01-17
Medium	4.3	EPSS 0.2%	CVE-2025-57942Emergency Password Reset (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.2%2025-09-22CVE Database V5CVE-2025-57942 Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through <= 9.3. EPSS 0.2%Vulnerability andy_moyle	CVE Database V5	2025-09-22
Medium	4.3	EPSS 0.3%	CVE-2025-39553Church Admin (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2025-09-09CVE Database V5CVE-2025-39553 Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2025-09-09
Medium	5.3	EPSS 0.2%	CVE-2025-57896Church Admin (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.2%2025-08-22CVE Database V5CVE-2025-57896 Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26. EPSS 0.2%Vulnerability andy_moyle	CVE Database V5	2025-08-22
Medium	6.5	EPSS 0.4%	CVE-2025-39555Church Admin (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.4%2025-04-16CVE Database V5CVE-2025-39555 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23. EPSS 0.4%Vulnerability andy_moyle	CVE Database V5	2025-04-16
Critical	9.3	EPSS 0.6%	CVE-2025-26941Church Admin (WordPress plugin) · SQL Injection Critical9.3EPSS 0.6%2025-03-26CVE Database V5CVE-2025-26941 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection.This issue affects Church Admin: from n/a through <= 5.0.18. EPSS 0.6%Vulnerability andy_moyle	CVE Database V5	2025-03-26
Medium	5.3	EPSS 0.6%	CVE-2024-53795Church Admin (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.6%2024-12-06CVE Database V5CVE-2024-53795 Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Church Admin: from n/a through <= 5.0.8. EPSS 0.6%Vulnerability andy_moyle	CVE Database V5	2024-12-06
Medium	4.3	EPSS 0.3%	CVE-2024-37440Church Admin (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2024-11-01CVE Database V5CVE-2024-37440 Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2024-11-01
High	7.1	EPSS 0.3%	CVE-2024-50438Church Admin (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2024-10-28CVE Database V5CVE-2024-50438 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2024-10-28
Critical	9.9	EPSS 0.5%	CVE-2024-37418Church Admin (WordPress plugin) · Unrestricted File Upload Critical9.9EPSS 0.5%2024-07-09CVE Database V5CVE-2024-37418 Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6. EPSS 0.5%Vulnerability andy_moyle	CVE Database V5	2024-07-09
Medium	6.5	EPSS 0.3%	CVE-2024-35764Church Admin (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.3%2024-06-21CVE Database V5CVE-2024-35764 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2024-06-21
Medium	4.4	EPSS 0.2%	CVE-2024-35637Church Admin (WordPress plugin) · Server-Side Request Forgery (SSRF) Medium4.4EPSS 0.2%2024-06-03CVE Database V5CVE-2024-35637 Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6. EPSS 0.2%Vulnerability andy_moyle	CVE Database V5	2024-06-03
Medium	6.3	EPSS 0.3%	CVE-2024-31281Church Admin (WordPress plugin) · Missing Authorization Medium6.3EPSS 0.3%2024-05-17CVE Database V5CVE-2024-31281 Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2024-05-17
Medium	4.3	EPSS 0.3%	CVE-2024-34828Church Admin (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.3%2024-05-10CVE Database V5CVE-2024-34828 Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32. EPSS 0.3%Vulnerability andy_moyle	CVE Database V5	2024-05-10
Medium	4.3	EPSS 0.2%	CVE-2024-32090Church Admin (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.2%2024-04-15CVE Database V5CVE-2024-32090 Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27. EPSS 0.2%Vulnerability andy_moyle	CVE Database V5	2024-04-15

Page 1 of 2