CVE-2015-4127: Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remot...

Security readout for executives and security teams

A WordPress site using the Church Admin plugin before 0.810 could allow an attacker to place malicious script or HTML through a registration form address field. If viewed by a user, that script could run in the browser under the site's context. Public references exist, but the supplied sources do not show active exploitation. Exposure is limited to WordPress deployments with the church_admin plugin installed below 0.810, especially sites exposing its registration form. The bundle's structured affected-product data is incomplete, so inventory should key on WordPress plugin name and version rather than CPEs. Prioritize remediation on public WordPress sites using this plugin, particularly those with registration forms enabled. The issue is old and publicly documented, but the supplied data lacks severity scoring and active exploitation evidence, so urgency depends on confirmed local exposure. Mitigation focus: Upgrade the church_admin WordPress plugin to version 0.810 or later.; Check the WordPress plugin changelog and vendor guidance before applying changes.; Disable the exposed registration form if upgrade cannot be completed promptly..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.