A reflected Cross-Site Scripting vulnerability in ChurchCRM allows unauthenticated attackers to execute malicious scripts in a user's browser, posing a significant risk of session theft.

This flaw involves an improper neutralization of input during web page generation (CWE-79/CWE-80) on the login page. An unauthenticated attacker can inject malicious JavaScript into the username parameter, which is rendered unsanitized in the login input field.

Successful exploitation allows an attacker to execute arbitrary scripts within the context of a victim's session. This could lead to the theft of sensitive session cookies or the manipulation of the login page to facilitate credential harvesting, ultimately resulting in unauthorized access to church management data. Given the CVSS score of 8.1, this represents a high-severity risk to organizational data integrity and user privacy.

Immediate Action: Upgrade ChurchCRM to version 7.1.0 or later to ensure the username parameter is properly sanitized.

Proactive Monitoring: Review web access logs for anomalous characters or script tags within the URL parameters associated with the login page.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured XSS protection rules to inspect and block malicious payloads directed at the login endpoint.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to user accounts through standard web-based attack vectors. Administrators should prioritize the update to version 7.1.0 immediately to remediate the underlying sanitization flaw and protect against potential session hijacking attempts.