Cross-site scripting in ChurchCRM - #VU142439
Published: August 13, 2026
Vulnerability identifier: #VU142439
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in an administrator\'s session.
The vulnerability exists due to improper neutralization of input during web page generation in the shared person action-menu renderer in src/skin/js/CRMJSOM.js when concatenating escaped person names into the data-person_name HTML attribute. A remote user can store a crafted person name and trigger script execution in an administrator\'s session to execute arbitrary script in an administrator\'s session.
User interaction is required because the administrator must open the dashboard action menu for the poisoned row.
Affected software
ChurchCRM
Remediation
Install security update from vendor's website.
ChurchCRM - update to 7.6.0