ChurchCRM, an open-source church management system, has a stored XSS vulnerability (CWE-79) in versions before 7.1.0. The flaw allows users with EditSelf permission to inject JavaScript into social media profile fields by splitting the payload across Facebook, LinkedIn, and X fields. The attack leverages onfocus event handlers chained across these fields to execute the payload when a profile is viewed. This can lead to session cookie theft from any user viewing the malicious profile. The vulnerability has a CVSS 3.1 score of 8.9, indicating high severity. The issue is resolved in ChurchCRM version 7.1.0.

Successful exploitation allows an attacker with limited permissions to execute arbitrary JavaScript in the context of other users' browsers, including administrators. This can lead to session cookie theft and potential account compromise. The impact includes confidentiality and integrity loss of user sessions and limited availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in ChurchCRM version 7.1.0. Users and administrators should upgrade to version 7.1.0 or later to remediate this issue. Since no official patch link or advisory is provided, confirm upgrade availability from the ChurchCRM project repository or official channels. Until upgraded, restrict EditSelf permissions if possible to reduce risk.