SB2026101932 - Cross-site scripting in ChurchCRM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101932

SB2026101932 - Cross-site scripting in ChurchCRM

Published: October 19, 2026

Security Bulletin ID SB2026101932
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser and access cookie or session information.

The vulnerability exists due to improper escaping of quotation marks in window.CRM.renderEventActionMenu() when inserting event titles into the quoted data-event_title attribute. A remote user can use the AddEvents permission to create an event with the title x" onmouseover="alert(document.cookie) to execute JavaScript when a victim views the dashboard or events list and hovers over the event's action button.


Remediation

Install update from vendor's website.

References