The Church Admin plugin for WordPress contains a stored Cross‑Site Scripting flaw that is triggered when an unauthenticated user supplies the "lat" parameter. Because the plugin does not properly sanitize or escape this value, arbitrary scripts can be persisted and executed whenever a victim renders a page that includes the injected content. The issue is only reachable if a Google Maps API key is configured, which activates the vulnerable code path.

WordPress installations running the Church Admin plugin version 5.1.7 or earlier, and any sites that have not upgraded beyond those releases. The vendor is Andy Moyle and the affected product is the Church Admin WordPress plugin.

The CVSS score of 7.2 classifies the vulnerability as high severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting lower public exploitation prevalence. Based on the description, the likely attack vector is an unauthenticated request to the plugin’s endpoint that accepts the "lat" parameter, possibly during site administration or content creation. Once exploited, an attacker can execute arbitrary JavaScript in the context of any user who visits the affected page, leading to theft of session data or malicious actions performed without the user’s knowledge.