ChurchCRM versions earlier than 6.8.2 allow an authenticated user with group edit rights to inject and persist JavaScript code in group records. When a group is viewed, the stored script executes in the browser of anyone who opens the group page. This stored cross‑site scripting flaw can lead to session hijacking, credential theft, or defacement of the interface, compromising the confidentiality and integrity of user data.

The affected product is the ChurchCRM community edition. Every installation running a version prior to 6.8.2 is vulnerable. The issue is fixed in release 6.8.2 and later.

The CVSS score of 2.1 indicates low severity, and the EPSS score below 1% suggests a low probability of exploitation at this time. The vulnerability requires the attacker to be authenticated and to possess edit permissions for groups, which is a relatively narrow target set. Because there is no public exploit or evidence in the KEV catalog, the risk is considered low, but administrators should still remediate promptly.