Plugin security history

Church Admin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with Church Admin, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

26Total records

0Critical

5High

20Medium

1Low

0Informational

26Patched records

0Currently marked unpatched

2015-05-22First disclosure

2026-01-16Latest disclosure

26 of 26CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2018	1	1 records
2022	1	1 records
2023	3	3 records
2024	15	15 records
2025	4	4 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	5	19.2%
Medium	20	76.9%
Low	1	3.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

8 records30.8%

First: 2015. Latest: 2025.

CSRF

5 records19.2%

First: 2018. Latest: 2024.

Missing Authorization

5 records19.2%

First: 2024. Latest: 2025.

Other

3 records11.5%

First: 2023. Latest: 2026.

SQL Injection

2 records7.7%

First: 2024. Latest: 2025.

Arbitrary File Upload

2 records7.7%

First: 2024. Latest: 2024.

Information Disclosure

1 record3.8%

First: 2025. Latest: 2025.

Patch Status

Patched: 26
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.0.29
5.0.27
5.0.24
5.0.10
5.0.19
5.0.9
5.0.0
4.4.7
4.4.5
4.4.0
4.2.0
4.1.6
4.1.7
4.1.19
4.1.8
4.0.28
4.0.27
4.1.18
3.8.0
3.7.30
3.7.6
3.4.135
1.2550
0.810

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.0.28`	Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter	January 16, 2026	5.0.29	Low
`*-5.0.26`	Church Admin <= 5.0.26 - Missing Authorization	August 22, 2025	5.0.27	Medium
`*-5.0.23`	Church Admin <= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 16, 2025	5.0.24	Medium
`*-5.0.9`	Church Admin <= 5.0.9 - Unauthenticated Information Disclosure	April 16, 2025	5.0.10	Medium
`*-5.0.18`	Church Admin <= 5.0.18 - Unauthenticated SQL Injection	March 13, 2025	5.0.19	High
`*-5.0.8`	Church Admin <= 5.0.8 - Missing Authorization	December 2, 2024	5.0.9	Medium
`[*, 5.0.0)`	Church Admin < 5.0.0 - Reflected Cross-Site Scripting	October 24, 2024	5.0.0	Medium
`*-4.4.6`	Church Admin <= 4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload	July 4, 2024	4.4.7	High
`*-4.4.4`	Church Admin <= 4.4.4 - Missing Authorization	June 28, 2024	4.4.5	Medium
`*-4.4.4`	Church Admin <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 17, 2024	4.4.5	Medium
`*-4.3.6`	Church Admin <= 4.3.6 - Authenticated (Admin+) Server-Side Request Forgery	May 30, 2024	4.4.0	Medium
`*-4.1.32`	Church Admin <= 4.1.32 - Cross-Site Request Forgery	May 9, 2024	4.2.0	Medium
`*-4.0.27`	Church Admin <= 4.0.27 - Cross-Site Request Forgery	April 11, 2024	4.0.28	Medium
`*-4.1.5`	Church Admin <= 4.1.5 - Authenticated (Subscriber+) Arbitrary File Upload	April 5, 2024	4.1.6	High
`*-4.1.6`	Church Admin <= 4.1.6 - Missing Authorization	April 5, 2024	4.1.7	Medium
`*-4.1.18`	Church Admin <= 4.1.18 - Missing Authorization	March 28, 2024	4.1.19	Medium
`*-4.1.7`	Church Admin <= 4.1.7 - Cross-Site Request Forgery	March 28, 2024	4.1.8	Medium
`*-4.0.27`	Church Admin <= 4.0.27 - Authenticated (Contributor+) SQL Injection	March 26, 2024	4.0.28	High
`*-4.0.26`	Church Admin <= 4.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode	March 25, 2024	4.0.27	Medium
`*-4.1.17`	Church Admin <= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text	March 25, 2024	4.1.18	Medium
`*-3.7.56`	Church Admin <= 3.7.56 - Server-Side Request Forgery via church_admin_import_csv	July 26, 2023	3.8.0	Medium
`*-3.7.29`	Church Admin <= 3.7.29 - Reflected Cross-Site Scripting	June 13, 2023	3.7.30	Medium
`*-3.7.5`	Church Admin <= 3.7.5 - Reflected Cross-Site Scripting	April 18, 2023	3.7.6	Medium
`[*, 3.4.135)`	Church Admin <= 3.4.134 - Cross-Site Request Forgery leading to Plugin Backup Disclosure	March 7, 2022	3.4.135	Medium
`[*, 1.2550)`	Church Admin < 1.2550 - Cross-Site Request Forgery	February 14, 2018	1.2550	High

Selected source records

Latest Records

LowCVE-2026-0682

Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter

Published: January 16, 2026

Affected versions: *-5.0.28
Patched versions: 5.0.29

Original Wordfence record

MediumCVE-2025-57896

Church Admin <= 5.0.26 - Missing Authorization

Published: August 22, 2025

Affected versions: *-5.0.26
Patched versions: 5.0.27

Original Wordfence record

MediumCVE-2025-39553

Church Admin <= 5.0.9 - Unauthenticated Information Disclosure

Published: April 16, 2025

Affected versions: *-5.0.9
Patched versions: 5.0.10

Original Wordfence record

MediumCVE-2025-39555

Church Admin <= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 16, 2025

Affected versions: *-5.0.23
Patched versions: 5.0.24

Original Wordfence record

HighCVE-2025-26941

Church Admin <= 5.0.18 - Unauthenticated SQL Injection

Published: March 13, 2025

Affected versions: *-5.0.18
Patched versions: 5.0.19

Original Wordfence record

MediumCVE-2024-53795

Church Admin <= 5.0.8 - Missing Authorization

Published: December 2, 2024

Affected versions: *-5.0.8
Patched versions: 5.0.9

Original Wordfence record

MediumCVE-2024-50438

Church Admin < 5.0.0 - Reflected Cross-Site Scripting

Published: October 24, 2024

Affected versions: [*, 5.0.0)
Patched versions: 5.0.0

Original Wordfence record

HighCVE-2024-37418

Church Admin <= 4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload

Published: July 4, 2024

Affected versions: *-4.4.6
Patched versions: 4.4.7

Original Wordfence record

Highest-Severity Records

HighCVE-2024-30244

Church Admin <= 4.0.27 - Authenticated (Contributor+) SQL Injection

Published: March 26, 2024

Affected versions: *-4.0.27
Patched versions: 4.0.28

Original Wordfence record

HighCVE-2018-20971

Church Admin < 1.2550 - Cross-Site Request Forgery

Published: February 14, 2018

Affected versions: [*, 1.2550)
Patched versions: 1.2550

Original Wordfence record

HighCVE-2024-31280

Church Admin <= 4.1.5 - Authenticated (Subscriber+) Arbitrary File Upload

Published: April 5, 2024

Affected versions: *-4.1.5
Patched versions: 4.1.6

Original Wordfence record

HighCVE-2024-37418

Church Admin <= 4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload

Published: July 4, 2024

Affected versions: *-4.4.6
Patched versions: 4.4.7

Original Wordfence record

HighCVE-2025-26941

Church Admin <= 5.0.18 - Unauthenticated SQL Injection

Published: March 13, 2025

Affected versions: *-5.0.18
Patched versions: 5.0.19

Original Wordfence record

MediumCVE-2024-35764

Church Admin <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 17, 2024

Affected versions: *-4.4.4
Patched versions: 4.4.5

Original Wordfence record

MediumCVE-2024-30193

Church Admin <= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text

Published: March 25, 2024

Affected versions: *-4.1.17
Patched versions: 4.1.18

Original Wordfence record

MediumCVE-2025-39555

Church Admin <= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: April 16, 2025

Affected versions: *-5.0.23
Patched versions: 5.0.24

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory