CVE-2026-27408

HighCVSS 7.1

Published: 02/07/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Summary

The NativeChurch plugin versions up to 4.8.8.2 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

Risk Assessment

The risk involves the ability to execute arbitrary JavaScript code in users' browsers, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Recommendation

It is recommended to immediately update the NativeChurch plugin to the latest available version that fixes this vulnerability. Also review the configuration for other potential XSS flaws.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.