Extension WordPress
Vulnérabilités Church Admin, page 2
Cette page rassemble les failles publiées pour Church Admin, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Church Admin
26 fiches
Church Admin <= 3.7.56 – Server-Side Request Forgery via church_admin_import_csv
The Church Admin plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.7.56 via the church_admin_import_csv function when importing from a csv file. This can allow authenticated attackers with administrator access to…
*-3.7.56
3.8.0
26/07/2023
Church Admin <= 3.7.29 – Reflected Cross-Site Scripting
The Church Admin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-3.7.29
3.7.30
13/06/2023
Church Admin <= 3.7.5 – Reflected Cross-Site Scripting
The Church Admin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $what variable parameter in versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-3.7.5
3.7.6
18/04/2023
Church Admin <= 3.4.134 – Cross-Site Request Forgery leading to Plugin Backup Disclosure
The Church Admin plugin for WordPress is vulnerable to Unauthenticated Backup Disclosure in versions up to, and including, 3.4.134. Attackers can repeatedly request the "refresh-backup" action and simultaneously request a publicly accessible temporary file generated by the plugin…
[*, 3.4.135)
3.4.135
07/03/2022
Church Admin < 1.2550 – Cross-Site Request Forgery
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
[*, 1.2550)
1.2550
14/02/2018
Church Admin < 0.810 – Stored Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.
[*, 0.810)
0.810
22/05/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.