A stored cross-site scripting vulnerability in ChurchCRM allows authenticated users with limited privileges to execute arbitrary JavaScript and hijack administrator sessions.

This is a stored cross-site scripting (CWE-79) vulnerability located in the person profile editing functionality. Authenticated users with EditSelf permissions can inject malicious payloads into social media profile fields, which execute when an administrator views the profile.

Successful exploitation allows an attacker to capture administrative session cookies, leading to full unauthorized access to the church management system. Given the CVSS score of 8.9, this vulnerability presents a high risk of data breach, unauthorized modification of records, and potential compromise of sensitive member information. The ability to escalate privileges through session hijacking makes this a severe threat to organizational data integrity.

Immediate Action: Update ChurchCRM to version 7.1.0 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web access logs for anomalous requests to the person profile editing endpoints and monitor for unexpected JavaScript execution or unauthorized session activity.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns in input fields.

Public Exploit Available: Unknown

This vulnerability represents a significant risk due to the potential for administrative account takeover. IT administrators should prioritize upgrading to ChurchCRM 7.1.0 to eliminate the underlying flaw. Until the update is applied, restrict the ability of non-administrative users to modify profile fields where possible to limit the attack surface.