Stored Cross-Site Scripting in Church Admin Plugin for WordPress

CVE-2026-123418

What is CVE-2026-123418?

The Church Admin plugin for WordPress suffers from a stored cross-site scripting vulnerability through the 'lat' parameter due to insufficient input validation and output escaping. This flaw allows malicious actors to inject arbitrary scripts that execute on user access to affected pages. Exploitation of this vulnerability requires the presence of a configured Google Maps API key in the Church Admin settings, enabling the vulnerable sink to be triggered. Users are encouraged to update to the latest version to mitigate any potential security threats.

References