A stored cross-site scripting vulnerability in ChurchCRM versions prior to 7.0.0 enables authenticated attackers to execute malicious scripts, potentially leading to full account compromise.

This is a stored cross-site scripting (CWE-79) vulnerability within the Person Property Management subsystem. An authenticated user can inject malicious JavaScript into person properties, which executes when other users view the profile or access the printable view.

Successful exploitation permits an attacker to perform actions on behalf of other users, including administrators, which may lead to session hijacking or the theft of sensitive church member data. Given the CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of the application environment.

Immediate Action: Upgrade ChurchCRM to version 7.0.0 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web application logs for suspicious script tags or encoded payloads being submitted to the Person Property Management interface.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and prevent the loading of untrusted resources.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available.

Organizations utilizing ChurchCRM must prioritize the update to version 7.0.0 immediately. Because this vulnerability allows for persistent malicious script execution, failing to patch leaves the system open to ongoing session hijacking and unauthorized administrative actions by any authenticated user on the platform.