The WPCHURCH plugin for WordPress is vulnerable to reflected cross-site scripting, which allows unauthenticated attackers to execute malicious scripts within a user's browser session.

This vulnerability is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can exploit this by injecting malicious scripts into the application, which are then executed in the victim's browser.

The exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information stored in the browser. Given the CVSS score of 7.1, this is a high-severity issue that poses a significant risk to user data integrity and account security. Organizations relying on this plugin for church management should treat this as a priority to prevent potential client-side compromises.

Immediate Action: Monitor the vendor for the release of a security patch and apply it immediately upon availability. If no update is available, consider deactivating the plugin until a fix is released.

Proactive Monitoring: Review web application access logs for suspicious URL parameters containing script tags or encoded characters indicative of XSS injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to inspect and sanitize incoming HTTP requests, effectively blocking malicious payloads before they reach the application.

Public Exploit Available: Unknown

The presence of a reflected XSS vulnerability in a public-facing plugin presents an unacceptable risk to user sessions. Security teams should prioritize monitoring the vendor advisory for a version beyond 2.7.0 and apply the update as soon as it is released. Until such time, implementing WAF rules to sanitize input is highly recommended to protect users from potential script execution.