Executive brief
ChurchCRM, an open-source church management system, is vulnerable to a security flaw that allows attackers to execute malicious scripts in the browsers of church staff or administrators. By tricking a user into clicking a specially crafted link, an attacker could steal login credentials, hijack active sessions, or access sensitive church member information. This could lead to full account takeover and unauthorized changes to the church's database.
Technical details
Multiple reflected Cross-Site Scripting (XSS) vulnerabilities exist in ChurchCRM due to insufficient output encoding of user-controlled request parameter names and values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization. Affected endpoints include /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. An unauthenticated remote attacker can exploit these by persuading a user to visit a malicious URL, leading to arbitrary JavaScript execution in the context of the victim's session. This can result in session hijacking, credential theft, and privilege escalation. The issue is fixed in version 7.4.0.
Affected products
- ChurchCRM CRM < 7.4.0
Timeline
- 2026-06-04: disclosed: Vulnerability discovered and reported to vendor
- 2026-07-13: advisory: CVE published to NVD
- 2026-07-13: patched: Fix released in version 7.4.0