ChurchCRM, an open-source church management system, contained a stored XSS vulnerability (CWE-79) in versions before 7.1.1. The issue arises from improper neutralization of input during web page generation in the group remove control and family editor state/country fields. This vulnerability is mainly exploitable in an admin-to-admin context when writable entity fields are abused. The vulnerability allows injection of malicious scripts that can compromise confidentiality and integrity of admin sessions. The vulnerability was fixed in ChurchCRM version 7.1.1.

Successful exploitation of this stored XSS vulnerability can lead to the execution of arbitrary scripts in the context of an admin user's browser, potentially compromising sensitive administrative functions and data confidentiality and integrity. The attack requires high privileges (admin) and user interaction (admin user visiting a crafted page). There is no impact on availability. No known exploits in the wild have been reported.

Upgrade ChurchCRM to version 7.1.1 or later, where this vulnerability is fixed. Since this is a stored XSS affecting admin users, applying the official patch is the recommended remediation. No alternative mitigations or temporary fixes are documented. Patch status is not explicitly stated but the vendor fixed the issue in 7.1.1, so updating to this version or later is required.