The CVE describes a stored cross‑site scripting flaw in the group‑creation form of ChurchCRM’s admin panel. An attacker who can create a group can embed malicious JavaScript into the group name field. When an administrator later views the page containing the stored data, the script executes in the administrator’s browser under their credentials. The injected code can capture the administrator’s session cookie, enabling a full administrative account takeover.

All ChurchCRM releases prior to 6.5.3 are affected. The vulnerability resides in the admin interface’s group‑creation feature and requires that the attacker has permissions to create groups.

The CVSS score of 8.0 signals high severity, while the EPSS score of less than 1% indicates a low expected exploitation frequency. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker attain group‑creation privileges, after which the insertion of malicious code is straightforward and the attack vector is local to the administrative interface. Successful exploitation would compromise administrative privileges, allowing the attacker to read and modify sensitive data and potentially launch further attacks within the system.