CVE-2026-94421

Name of the Vulnerable Software and Affected Versions Church Admin plugin for WordPress versions prior to 5.1.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the email parameter, which then execute when a user accesses the affected page.

Recommendations Update the plugin to a version newer than 5.1.2. Avoid using the email parameter until the update is applied.