Cross-site scripting in ChurchCRM - #VU156127
Published: October 19, 2026
Vulnerability identifier: #VU156127
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser and access cookie or session information.
The vulnerability exists due to improper escaping of quotation marks in window.CRM.renderEventActionMenu() when inserting event titles into the quoted data-event_title attribute. A remote user can use the AddEvents permission to create an event with the title x" onmouseover="alert(document.cookie) to execute JavaScript when a victim views the dashboard or events list and hovers over the event's action button.
Affected software
ChurchCRM
Remediation
Install security update from vendor's website.
ChurchCRM - update to 7.7.0