CVE-2026-123418

Name of the Vulnerable Software and Affected Versions Church Admin versions prior to 5.1.8

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is only exploitable if a Google Maps API key is configured in the settings, as the vulnerable sink is only reached under this condition. The flaw is triggered via the lat parameter.

Recommendations Update Church Admin to version 5.1.8 or later. As a temporary mitigation, remove the Google Maps API key from the Church Admin settings to prevent the vulnerable sink from being reached.