EUVD-2026-19823Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0.
AnalysisAI
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrate administrator session cookies through stored XSS in social media profile fields. Attackers chain JavaScript payloads across Facebook, LinkedIn, and X fields using onfocus event handlers to bypass 50-character limits, automatically executing when any user (including administrators) views the malicious profile. No public exploit code or confirmed active exploitation identified at time of analysis, though EPSS data unavailable. CVSS 8.9 reflects high impact but requires authenticated access and user interaction.
Technical ContextAI
This is a stored cross-site scripting (CWE-79) vulnerability in ChurchCRM's person profile management module. The vulnerability exploits insufficient input sanitization and output encoding in social media profile fields (Facebook, LinkedIn, X/Twitter). The attack demonstrates an advanced payload fragmentation technique where malicious JavaScript is split across three separate 50-character-limited input fields and reassembled at execution time through chained onfocus event handlers. When rendered in the profile view, the browser executes the combined payload without user awareness. This affects the churchcrm:crm product as identified by CPE 2.3:a:churchcrm:crm, specifically the profile editing and viewing functionality accessible to users with EditSelf permissions. The stored nature makes it particularly dangerous as the payload persists in the database and executes repeatedly whenever the profile is accessed.
RemediationAI
Upgrade immediately to ChurchCRM version 7.1.0 or later, which contains vendor-released patches addressing the stored XSS vulnerability in social media profile fields. Organizations should prioritize this upgrade for any deployments with multiple authenticated users, particularly those with administrative access. Until patching is complete, temporary risk mitigation can include restricting EditSelf permissions to trusted users only, implementing web application firewall rules to detect onfocus event handler patterns in profile updates, or disabling the social media profile fields through database constraints. Review access logs for profile edit activity and administrator session usage to identify potential exploitation attempts. The complete vendor security advisory and patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm. After upgrading, audit existing user profiles for suspicious content in Facebook, LinkedIn, and X fields and sanitize any anomalous entries.
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Ra
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitab
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within th
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpo
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET param
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST para
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today