A stored cross‑site scripting flaw in ChurchCRM’s PersonView.php allows authenticated users with EditRecords privileges to inject malicious JavaScript into a person’s Facebook field. The flaw arises because sanitizeText only removes tags but fails to escape quotation marks, enabling a break‑out from an href attribute. When another user visits that profile, the injected script runs in their browser, permitting session hijacking and complete account takeover. This weakness involves improper input validation and unsafe output handling.

ChurchCRM version 7.0.x and earlier, before the 7.1.0 release, are affected. The vulnerability is tied to the PersonView.php component in the core CRM application. All installations that have not applied the 7.1.0 patch or that continue to use the default Facebook field storage are vulnerable, regardless of deployment size or database configuration.

The CVSS v3 score of 7.6 indicates high severity. Because exploitation requires legitimate user authentication and a role that allows record edits, the attack surface is limited to users who can edit church member data. EPSS is below 1%, suggesting current exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog. The high impact combined with the ability to hijack admin sessions makes the flaw a priority for remediation. An attacker would need to compromise an EditRecords account to insert the payload, after which arbitrary code could run in anyone’s browser viewing the injected profile.