ChurchCRM, an open-source church management system, had a Blind Reflected Cross-Site Scripting vulnerability in versions before 7.1.0. The vulnerability occurs because the application does not properly sanitize or encode user-supplied input in the search parameter before rendering it in the browser's DOM. Despite the server responding with an HTTP 500 error due to the malformed request, the browser executes injected <script> tags before processing the error response, enabling code execution. This vulnerability is addressed and fixed in version 7.1.0 of ChurchCRM.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, credential theft, or other malicious actions within the scope of the ChurchCRM application. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. There are no known exploits in the wild at this time.

Upgrade ChurchCRM to version 7.1.0 or later, where this vulnerability has been fixed. Since the vendor advisory confirms the fix in 7.1.0, applying this official update is the recommended remediation. No other mitigation steps are indicated.