EUVD-2026-19823Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Lifecycle Timeline
6DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0.
AnalysisAI
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrate administrator session cookies through stored XSS in social media profile fields. Attackers chain JavaScript payloads across Facebook, LinkedIn, and X fields using onfocus event handlers to bypass 50-character limits, automatically executing when any user (including administrators) views the malicious profile. No public exploit code or confirmed active exploitation identified at time of analysis, though EPSS data unavailable. CVSS 8.9 reflects high impact but requires authenticated access and user interaction.
Technical ContextAI
This is a stored cross-site scripting (CWE-79) vulnerability in ChurchCRM's person profile management module. The vulnerability exploits insufficient input sanitization and output encoding in social media profile fields (Facebook, LinkedIn, X/Twitter). The attack demonstrates an advanced payload fragmentation technique where malicious JavaScript is split across three separate 50-character-limited input fields and reassembled at execution time through chained onfocus event handlers. When rendered in the profile view, the browser executes the combined payload without user awareness. This affects the churchcrm:crm product as identified by CPE 2.3:a:churchcrm:crm, specifically the profile editing and viewing functionality accessible to users with EditSelf permissions. The stored nature makes it particularly dangerous as the payload persists in the database and executes repeatedly whenever the profile is accessed.
RemediationAI
Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains vendor-released patches addressing the stored XSS vulnerability in social media profile fields. Organizations should prioritize this upgrade for any deployments with multiple authenticated users, particularly those with administrative access. Until patching is complete, temporary risk mitigation can include restricting EditSelf permissions to trusted users only, implementing web application firewall rules to detect onfocus event handler patterns in profile updates, or disabling the social media profile fields through database constraints. Review access logs for profile edit activity and administrator session usage to identify potential exploitation attempts. The complete vendor security advisory and patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm. After upgrading, audit existing user profiles for suspicious content in Facebook, LinkedIn, and X fields and sanitize any anomalous entries.
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP c
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. Rated medium severity (CVSS 6.1), this vulner
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by i
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path trav
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary S
Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScri
Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrar
Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover throu
Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access rea
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound
Reflected Cross-Site Scripting in ChurchCRM before 7.4.0 lets remote attackers inject JavaScript through unsanitized req
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today