EUVD-2026-19812Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.
AnalysisAI
Stored XSS in ChurchCRM prior to 7.1.1 allows authenticated administrators to inject malicious scripts via group remove controls and family editor state/country fields. The vulnerability requires high-privilege account access and user interaction to trigger, making it an admin-to-admin attack surface rather than a direct threat to end-users. ChurchCRM 7.1.1 and later contain the fix.
Technical ContextAI
ChurchCRM is an open-source church management system built on web technologies. The vulnerability stems from improper input validation and output encoding in HTML contexts, specifically in two administrative UI components: the group remove control and family editor form fields for state/country. CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting) indicates that user-supplied data from writable entity fields is rendered back into the page without adequate HTML escaping or Content Security Policy protections. The attack surface is limited to authenticated administrator accounts with write permissions to these specific entity attributes, reducing exposure compared to unauthenticated XSS vulnerabilities.
RemediationAI
Upgrade ChurchCRM to version 7.1.1 or later to apply the vendor-released patch. Organizations unable to upgrade immediately should restrict administrative access to users with a demonstrated need for entity editing functionality, and consider implementing network-level controls to limit exposure of the ChurchCRM administrative interface. Monitor audit logs for unusual administrative activity, particularly modifications to group and family entity fields. See https://github.com/ChurchCRM/CRM/security/advisories/GHSA-44j4-jjw2-wcr6 for additional mitigation guidance from the vendor.
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Ra
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitab
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within th
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpo
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET param
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST para
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today