{"id":"CVE-2026-123418","kind":"vulnerability","aliases":["CVE-2026-123418"],"related":[],"title":"WordPress Church Admin plugin: unauthenticated stored script injection via lat parameter","description":"The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present.","summary":"The Church Admin WordPress plugin up to and including 5.1.7 does not sanitize the 'lat' parameter before storing and displaying it. An unauthenticated attacker can inject scripts into pages that run in the browser of anyone who opens the injected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"church-admin","fixed":["5.1.8"],"affected":"<= 5.1.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["church-admin","package","self-hosted","wordpress"],"not_affected_if":["no-google-maps-api-key","plugin-updated"],"how_to_check":"- In WordPress admin > Plugins, check the Church Admin version; 5.1.7 and earlier are vulnerable, 5.1.8 is fixed.\n- Check Church Admin settings for a Google Maps API key; Wordfence says the vulnerable code is only reached when one is configured.\n- After updating, look for unfamiliar script or odd strings in saved address/map data and for unknown admin accounts.","fix":"Update the Church Admin plugin to 5.1.8 or later (WordPress admin > Plugins). If you cannot update yet, remove the Google Maps API key from Church Admin settings or deactivate the plugin.","status":"open","published_at":"2026-11-07T12:17:45+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","triaged_at":"2026-11-07T12:48:48+00:00","updated_at":"2026-11-07T12:50:13+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-07T12:48:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Church Admin plugin: unauthenticated stored script injection via lat parameter","impact":"medium","summary":"The Church Admin WordPress plugin up to and including 5.1.7 does not sanitize the 'lat' parameter before storing and displaying it. An unauthenticated attacker can inject scripts into pages that run in the browser of anyone who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","church-admin","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"injected scripts run in visitors' browsers on the site","analyst_note":"Confirm the fixed plugin version on the NVD entry or the WordPress plugin changelog, since the sources give none.","how_to_check":"- Check the installed Church Admin plugin version in the WordPress admin Plugins screen; versions up to and including `5.1.7` are listed as vulnerable.\n- Check whether a Google Maps API key is set in Church Admin settings; the sources say the flaw is only reachable when one is configured.","plain_action":"","needs_analyst":true,"not_affected_if":["no-google-maps-api-key","plugin-updated"],"who_is_affected":"Sites running the Church Admin plugin at version 5.1.7 or earlier with a Google Maps API key configured in its settings. The sources say the flaw is only reached when that key is present, so sites without it can skip it. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4313,"output_tokens":570,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version on the NVD entry or the WordPress plugin changelog, since the sources give none.","search":"'-123418':14A,17A '-2026':13A,16A '5.1.7':38B,95C 'access':124C 'admin':3A,20A,23B,31B,72C,144C 'anyon':64B 'api':137C 'arbitrari':113C 'attack':52B,110C 'browser':62B 'church':2A,19A,22B,30B,71C,143C 'church-admin':18A,21B 'configur':141C 'cross':81C 'cross-sit':80C 'cve':12A,15A 'display':48B 'due':96C 'escap':103C 'execut':120C 'exploit':132C 'googl':135C 'host':27B 'includ':37B,94C 'inject':8A,54B,68B,112C,126C 'input':99C 'insuffici':98C 'key':138C 'lat':10A,43B,86C 'make':105C 'map':136C 'open':66B 'option':155C 'output':102C 'packag':24B 'page':57B,69B,117C,127C 'paramet':11A,44B,87C 'plugin':4A,33B,73C 'possibl':107C 'present':157C 'reach':152C 'run':59B 'sanit':41B,100C 'script':7A,55B,83C,115C 'self':26B 'self-host':25B 'set':145C 'sink':149C 'site':82C 'store':6A,46B,79C 'unauthent':5A,51B,109C 'user':123C 'version':90C 'via':9A,84C 'vulner':77C,129C,148C 'web':114C 'whenev':121C 'wordpress':1A,28B,32B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Church Admin plugin at version 5.1.7 or earlier with a Google Maps API key configured in its settings. The sources say the flaw is only reached when that key is present, so sites without it can skip it. The sources do not name a fixed version.","tier":"B","verified":{"fix":{"at":"2026-11-07T12:50:13Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/church-admin/church-admin-517-unauthenticated-stored-cross-site-scripting-via-lat-parameter","run_id":2110}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["churchadmin"],"ptokens":["admin","church"],"labels":["churchadmin","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123418':14A,17A '-2026':13A,16A 'admin':3A,20A 'church':2A,19A 'church-admin':18A 'cve':12A,15A 'inject':8A 'lat':10A 'paramet':11A 'plugin':4A 'script':7A 'store':6A 'unauthent':5A 'via':9A 'wordpress':1A","search_b":"'5.1.7':38B 'admin':23B,31B 'anyon':64B 'attack':52B 'browser':62B 'church':22B,30B 'church-admin':21B 'display':48B 'host':27B 'includ':37B 'inject':54B,68B 'lat':43B 'open':66B 'packag':24B 'page':57B,69B 'paramet':44B 'plugin':33B 'run':59B 'sanit':41B 'script':55B 'self':26B 'self-host':25B 'store':46B 'unauthent':51B 'wordpress':28B,32B","search_c":"'5.1.7':95C 'access':124C 'admin':72C,144C 'api':137C 'arbitrari':113C 'attack':110C 'church':71C,143C 'configur':141C 'cross':81C 'cross-sit':80C 'due':96C 'escap':103C 'execut':120C 'exploit':132C 'googl':135C 'includ':94C 'inject':112C,126C 'input':99C 'insuffici':98C 'key':138C 'lat':86C 'make':105C 'map':136C 'option':155C 'output':102C 'page':117C,127C 'paramet':87C 'plugin':73C 'possibl':107C 'present':157C 'reach':152C 'sanit':100C 'script':83C,115C 'set':145C 'sink':149C 'site':82C 'store':79C 'unauthent':109C 'user':123C 'version':90C 'via':84C 'vulner':77C,129C,148C 'web':114C 'whenev':121C 'wordpress':75C","first_public_at":"2026-11-07T12:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123418","severity":null,"published_at":"2026-11-07T12:17:45+00:00","modified_at":"2026-11-07T12:17:46+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","fetched_at":"2026-11-07T12:47:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123418:2110","url":"https://wordpress.org/plugins/church-admin/","severity":null,"published_at":"2026-11-07T12:50:13+00:00","modified_at":"2026-11-07T12:50:13+00:00","first_seen_at":"2026-11-07T12:50:13+00:00","fetched_at":"2026-11-07T12:50:13+00:00","note":"Fixed in 5.1.8: maintainer changelog on wordpress.org ('Fix lat/lng XSS vulnerability'); Wordfence, Patchstack, WPScan agree. Only fix verified; affected range/precondition come from Wordfence, not the maintainer. No exploitation or PoC seen.","cites":["https://wordpress.org/plugins/church-admin/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/church-admin/church-admin-517-unauthenticated-stored-cross-site-scripting-via-lat-parameter"]}],"documents":[{"id":95550,"url":"https://wordpress.org/plugins/church-admin/","title":"Church Admin changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":95552,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/church-admin/church-admin-517-unauthenticated-stored-cross-site-scripting-via-lat-parameter","title":"Wordfence: Church Admin <= 5.1.7 stored XSS via lat","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}