EUVD-2026-19833Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path where writable configuration fields are abused. This vulnerability is fixed in 7.1.0.
AnalysisAI
Stored cross-site scripting in ChurchCRM prior to version 7.1.0 allows authenticated administrators with high privileges to inject malicious scripts through configuration fields, Person editor defaults, and self-registration form defaults, which are then rendered without sanitization when accessed by other administrators or users. The vulnerability requires admin interaction to exploit (UI:R) and affects confidentiality and integrity but not availability. No public exploit code or active exploitation has been identified.
Technical ContextAI
ChurchCRM is an open-source church management system written in PHP/JavaScript. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) affecting multiple input vectors: Directory Reports form field configuration, Person editor default values, and external self-registration form defaults. The root cause is insufficient input validation and output encoding in the application's form handling logic. These configuration fields are stored in the application database or configuration files and are rendered directly into HTML contexts without proper escaping, allowing attackers with administrative credentials to craft payloads that execute when the forms are viewed by other administrators or in user interfaces. The affected product is identified by CPE cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, covering all ChurchCRM versions prior to 7.1.0.
RemediationAI
Vendor-released patch: ChurchCRM 7.1.0. Upgrade to version 7.1.0 or later immediately to obtain the security fix. Users unable to upgrade immediately should restrict administrative access to trusted personnel only and implement network-level access controls to limit who can access the ChurchCRM administrative interface. Input validation and output encoding improvements are included in the patched version. For detailed patch notes and upgrade instructions, refer to the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r8cp-gg58-2r2r.
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP c
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. Rated medium severity (CVSS 6.1), this vulner
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by i
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path trav
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrat
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary S
Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScri
Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrar
Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover throu
Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access rea
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today