Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0.
Published: 2026-01-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation, leading to reflected XSS within the WPCHURCH plugin. An attacker can craft a URL or form submission that causes the plugin to echo user‑supplied data without proper encoding, allowing arbitrary JavaScript execution in the browser of any user who loads the crafted content. This can lead to session hijacking, credential theft, or defacement of the site, compromising confidentiality, integrity, and availability of user sessions.

Affected Systems

Dasinfomedia WPCHURCH plugin versions up to and including 2.7.0 are affected. Administrators should verify their plugin version and ensure it is not within this vulnerable range.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate to high severity, while an EPSS score of less than 1% suggests exploitation activity is expected to be low. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by sending a crafted request that includes the untrusted input processed by the plugin; the bug requires the affected parameter to appear in a page rendered to a user.

Generated by OpenCVE AI on April 30, 2026 at 14:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WPCHURCH plugin to the latest available version, removing the reflected XSS flaw
  • If an upgrade is not immediately feasible, disable the WPCHURCH plugin until a patched version is available to prevent accidental execution of the vulnerable code
  • Deploy a web application firewall rule that blocks or sanitizes input parameters known to trigger the XSS vector, reducing the risk of exploitation while a patch is applied

Generated by OpenCVE AI on April 30, 2026 at 14:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 28 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH church-management allows Reflected XSS.This issue affects WPCHURCH: from n/a through <= 2.7.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0.
References

Thu, 23 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH church-management allows Reflected XSS.This issue affects WPCHURCH: from n/a through <= 2.7.0.
References

Wed, 07 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Dasinfomedia
Dasinfomedia wpchurch Church Management System
Wordpress
Wordpress wordpress
Vendors & Products Dasinfomedia
Dasinfomedia wpchurch Church Management System
Wordpress
Wordpress wordpress

Tue, 06 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Jan 2026 21:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0.
Title WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Dasinfomedia Wpchurch Church Management System
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:10.959Z

Reserved: 2025-03-31T10:06:37.636Z

Link: CVE-2025-31642

cve-icon Vulnrichment

Updated: 2026-01-06T21:23:00.987Z

cve-icon NVD

Status : Deferred

Published: 2026-01-07T02:14:11.380

Modified: 2026-04-28T19:31:13.683

Link: CVE-2025-31642

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T14:30:06Z

Weaknesses