Cross-site scripting in ChurchCRM - #VU139932
Published: July 28, 2026
Vulnerability identifier: #VU139932
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to cross-site scripting in GroupView.js and GroupRoles.js when rendering unescaped group-role names returned by the roles API into the DOM as HTML. A remote user can create or leverage a crafted role name to execute arbitrary script in a victim's browser.
Exploitation requires authenticated access and a role or option name that bypasses the normal sanitization paths, such as pre-existing unsanitized data, migrated records, or data introduced through alternate write paths. User interaction is required to open the affected group's view page.
Affected software
ChurchCRM
Remediation
Install security update from vendor's website.
ChurchCRM - update to 7.4.3