The Church Admin plugin for WordPress allows an authenticated user with subscriber or higher privileges to create an email entry that is stored without proper sanitization or escaping. When the email value is rendered on a page, attacker‑supplied scripts execute in the browsers of all visitors to that page. This form of stored cross‑site scripting can lead to client‑side script execution, cookie theft, session hijack, or defacement of content, depending on the payload injected. The vulnerability is a classic example of input validation failure as identified by CWE‑79.

WordPress sites that use the Church Admin plugin version 5.1.2 or earlier are impacted. The flaw exists in all political editions of the plugin up through 5.1.2; upgrade to 5.1.3 or later resolves the issue, as demonstrated by the changes in the plugin repository. No other WordPress components are affected by this specific flaw.

The CVSS score of 6.4 indicates moderate severity. Because the flaw requires authenticated access at subscriber level or higher, an attacker must first gain legitimate credentials before exploiting the vector, which reduces the attack surface compared to public exploits. EPSS data is not available, but the absence of a KEV listing suggests that known, off‑the‑shelf exploitation is not currently widespread. Still, once a legitimate user submits a crafted email value, the stored script will run for every user who accesses the affected content, making the risk significant for any site with a large user base.