Church Admin vulnerabilities

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 5.1.2. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject scripts.

The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.