WPCHURCH - Church Management System for Wordpress

WPCHURCH - Church Management System for Wordpress has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2025; 1 is fixed and 4 remain unpatched as of September 2026. Their average CVSS score is 8.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (20%). Other recurring categories include Incorrect Privilege Assignment, PHP Remote File Inclusion.

1 of the records (20%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, most of them (3) reported by Cút lộn xào me.

Strategic Overview

Avg CVSSHigh

8.2/ 10

Patch Coverage20%

Open

Fixed

Get automatic notifications for all WPCHURCH - Church Management System for Wordpress vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2025-32304

WPCHURCH <= 2.7.0 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

5 records


2025-06-03 00:00	WPCHURCH <= 2.7.0 - Unauthenticated SQL Injection WPCHURCH - Church Management System… <= 2.7.0	`CVE-2025-32303`	7.5 High	Annn	No
2025-05-30 00:00	WPCHURCH <= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation WPCHURCH - Church Management System… <= 2.7.0	`CVE-2025-31643`	8.8 High	Cút lộn xào me	No
2025-05-20 00:00	WPCHURCH <= 2.7.0 - Reflected Cross-Site Scripting WPCHURCH - Church Management System… <= 2.7.0	`CVE-2025-31642`	6.1 Medium	Cút lộn xào me	No
2025-05-16 00:00	WPCHURCH <= 2.7.0 - Unauthenticated Local File Inclusion WPCHURCH - Church Management System… <= 2.7.0	`CVE-2025-32304`	9.8 Critical	Cút lộn xào me	No
2017-09-26 00:00	WPCHURCH - Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection WPCHURCH - Church Management System… < 13-07-2019	`CVE-2017-14845`	8.8 High	Ihsan Sencan	Yes

Showing 1–5 of 5 reports