ChurchCRM, an open-source church management system, contained a stored XSS vulnerability (CWE-79) in versions before 7.1.1. The flaw exists in the group remove control and family editor state/country fields, where input is not properly neutralized during web page generation. This vulnerability mainly allows an admin user to inject malicious scripts that execute in the context of other admin users. The issue was addressed and fixed in ChurchCRM version 7.1.1.

Successful exploitation of this vulnerability could allow an attacker with admin privileges to execute arbitrary scripts in the browsers of other admin users, potentially leading to credential theft or unauthorized actions within the admin interface. The vulnerability does not impact availability but has high confidentiality and integrity impact as per the CVSS vector.

Upgrade ChurchCRM to version 7.1.1 or later, where this stored XSS vulnerability has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional vendor advisory or temporary fixes are indicated.