ChurchCRM security vulnerabilities

ChurchCRM is an open source CRM system built for churches by ChurchCRM Open Source. A security vulnerability exists in ChurchCRM 5.13.0 and earlier versions, which stems from the CurrentFundraiser parameter being directly connected to a SQL query without sufficient cleanup, which can be exploited...

WordPress plugin Cosmic Blocks (40+) – Content Editor Blocks Collection: Cross-site scripting vulnerabilities

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Cosmic...

CVE-2025-22888: Improper Neutralization of Input During Web Page Generation

Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2025-7494 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM versions 5.13.0 and prior Description: A boolean-based and time-based blind SQL Injection vulnerability exists in the DonatedItemEditor functionality, allowing an attacker to execute arbitrary SQL queries. The CurrentFundraiser...

PT-2025-7542 · Unknown · Movable Type

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in...

PT-2025-7546 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: Movable Type contains a stored cross-site scripting issue in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor, allowing an arbitrary...

CVE-2024-13674: Improper Neutralization of Input During Web Page Generation

The Cosmic Blocks 40+ Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwpsocialshare' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-12173: Improper Neutralization of Input During Web Page Generation

The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-7378

Name of the Vulnerable Software and Affected Versions The Cosmic Blocks 40+ Content Editor Blocks Collection plugin for WordPress versions up to, and including, 1.3.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's cwp social share shortcode due to insufficient...

CVE-2025-26603

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the :redir ex command to register, variables and files. It also allows to show the contents of registers using the :registers or :display ex command. When redirecting the output of...

CVE-2025-0981

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2024-13852

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13852

CVE-2024-13852 affects the WordPress plugin Option Editor (version 1.0). The root cause is missing nonce validation in the plugin_page() function, enabling CSRF. This allows unauthenticated attackers to forge requests to update arbitrary site options, potentially setting the default registration ...

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

WordPress Plugin Option Editor Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery...