The Church Admin plugin performs inadequate neutralization of user input, enabling attackers to store malicious scripts that are subsequently injected into web pages rendered for other visitors. This stored XSS flaw can facilitate session hijacking, cookie theft, defacement, or delivery of additional malware, impacting the confidentiality, integrity, and availability of the website. The weakness is classified as CWE‑79.

Vendor andy_moyle released the Church Admin plugin, which is affected in all releases from an unspecified base through version 5.0.23. Users operating any of these versions are potentially vulnerable.

The assessed CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Inferred attack vector requires an attacker to inject data through the plugin’s input mechanisms—likely through administrative or content‑editing privileges—before other users view the affected content. No documented exploit chain is available, though the stored nature of the flaw reduces the required attacker capability once the malicious script is present.