CVE-2025-39555: Church Admin Plugin Stored XSS Vulnerability

CVE-2025-39555 Overview

CVE-2025-39555 is a stored Cross-Site Scripting (XSS) vulnerability in the Church Admin WordPress plugin developed by andy_moyle. The flaw affects all versions up to and including 5.0.23 and stems from improper neutralization of user input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected pages. Because the vulnerability crosses a security scope (S:C in the CVSS vector), payloads can affect components beyond the plugin itself, including administrators interacting with the WordPress dashboard.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes against other users, enabling session theft, administrative action hijacking, and defacement of Church Admin content.

Affected Products

Church Admin WordPress plugin by andy_moyle
All versions from initial release through 5.0.23
WordPress sites running the vulnerable plugin with contributor-level or higher user accounts

Discovery Timeline

2025-04-16 - CVE-2025-39555 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39555

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Church Admin plugin. User-supplied input is written to persistent storage and later rendered into WordPress pages without adequate output encoding or sanitization. When another user loads a page containing the injected payload, the malicious script executes in their browser session under the origin of the WordPress site.

Exploitation requires the attacker to hold an authenticated account with permissions to submit content processed by the plugin. User interaction is required to trigger the payload, typically an administrator or logged-in visitor viewing the affected view.

The scope-changed impact means a payload injected through a low-privileged plugin context can act against higher-privileged users viewing the same content, including WordPress administrators. This creates a path to full site takeover through techniques such as forcing plugin installation, creating new admin users, or exfiltrating authentication cookies.

Root Cause

The root cause is missing or insufficient input sanitization on data submitted to the plugin, combined with the absence of contextual output escaping when that data is rendered into HTML. WordPress provides functions such as sanitize_text_field(), wp_kses(), and esc_html() for these purposes, and the vulnerable code paths do not apply them consistently.

Attack Vector

The attack vector is network-based. An authenticated user submits crafted input containing HTML or JavaScript through a Church Admin plugin form. The malicious content is stored in the WordPress database. When a victim, typically an administrator or logged-in user, views the affected page, the browser parses and executes the attacker-controlled script.

Refer to the Patchstack WordPress Plugin Advisory for additional technical details on the affected parameters.

Detection Methods for CVE-2025-39555

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in Church Admin database tables
New WordPress administrator accounts or role changes created without an authorized change record
Outbound HTTP requests from administrator browser sessions to unfamiliar domains shortly after loading Church Admin pages
Unexpected plugin or theme installations following administrator visits to affected pages

Detection Strategies

Review Church Admin plugin database entries for HTML markup, script tags, or encoded payloads such as <script>
Deploy a web application firewall (WAF) rule set that inspects POST bodies to plugin endpoints for XSS signatures
Enable WordPress activity logging to track content submissions made by contributor and editor accounts

Monitoring Recommendations

Monitor administrator sessions for anomalous API calls to /wp-admin/ endpoints such as user-new.php or plugin-install.php
Alert on Content Security Policy (CSP) violation reports if a report-only policy is configured
Track authentication events and session token reuse from unexpected IP addresses following administrator page views

How to Mitigate CVE-2025-39555

Immediate Actions Required

Audit WordPress sites for the Church Admin plugin and identify any installation at version 5.0.23 or earlier
Deactivate the Church Admin plugin until a patched version can be verified and installed
Review all user accounts with contributor privileges or higher and remove accounts that are not required
Inspect existing Church Admin content in the database and remove any entries containing script tags or suspicious HTML

Patch Information

At the time of publication, the advisory identifies all versions through 5.0.23 as vulnerable. Consult the Patchstack WordPress Plugin Advisory and the plugin's WordPress.org page for the latest fixed release, and update to that version or later.

Workarounds

Restrict Church Admin plugin form access to trusted authenticated users only
Deploy a WAF with XSS filtering rules in front of the WordPress site
Configure a strict Content Security Policy header that disallows inline scripts to reduce payload execution
If updates are not available, remove the plugin and use an alternative until a patched release is confirmed

bash

# Example: enforce a restrictive Content Security Policy in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"