The Church Admin plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'email' parameter in versions up to and including 5.1.2. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts, which execute when a user accesses an injected page. The vulnerability is due to insufficient input sanitization and output escaping. Defenders shoul [truncated]
A Missing Authorization vulnerability in the Church Admin plugin for WordPress, versions up to and including 5.0.30, allows attackers to exploit incorrectly configured access control security levels. This issue has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability impacts WordPress installations with the Church Admin plugin, as defenders need to verify and update the plugin to pr [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the Emergency Password Reset plugin up to version 8.0. This issue allows attackers to trick users into performing unintended actions on the website. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. Users of the Emergency Password Reset plugin should take immediate action to protect their sites.
