EUVD-2026-19833Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path where writable configuration fields are abused. This vulnerability is fixed in 7.1.0.
AnalysisAI
Stored cross-site scripting in ChurchCRM prior to version 7.1.0 allows authenticated administrators with high privileges to inject malicious scripts through configuration fields, Person editor defaults, and self-registration form defaults, which are then rendered without sanitization when accessed by other administrators or users. The vulnerability requires admin interaction to exploit (UI:R) and affects confidentiality and integrity but not availability. No public exploit code or active exploitation has been identified.
Technical ContextAI
ChurchCRM is an open-source church management system written in PHP/JavaScript. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) affecting multiple input vectors: Directory Reports form field configuration, Person editor default values, and external self-registration form defaults. The root cause is insufficient input validation and output encoding in the application's form handling logic. These configuration fields are stored in the application database or configuration files and are rendered directly into HTML contexts without proper escaping, allowing attackers with administrative credentials to craft payloads that execute when the forms are viewed by other administrators or in user interfaces. The affected product is identified by CPE cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, covering all ChurchCRM versions prior to 7.1.0.
RemediationAI
Vendor-released patch: ChurchCRM 7.1.0. Upgrade to version 7.1.0 or later immediately to obtain the security fix. Users unable to upgrade immediately should restrict administrative access to trusted personnel only and implement network-level access controls to limit who can access the ChurchCRM administrative interface. Input validation and output encoding improvements are included in the patched version. For detailed patch notes and upgrade instructions, refer to the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r8cp-gg58-2r2r.
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Ra
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitab
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploit
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within th
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpo
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET param
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST para
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today