EUVD-2026-19833
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Tags
Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path where writable configuration fields are abused. This vulnerability is fixed in 7.1.0.
Analysis
Stored cross-site scripting in ChurchCRM prior to version 7.1.0 allows authenticated administrators with high privileges to inject malicious scripts through configuration fields, Person editor defaults, and self-registration form defaults, which are then rendered without sanitization when accessed by other administrators or users. The vulnerability requires admin interaction to exploit (UI:R) and affects confidentiality and integrity but not availability. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today