ChurchCRM, an open‑source church management system, contains a stored cross‑site scripting vulnerability in its Person Property Management subsystem. An authenticated user can inject arbitrary JavaScript into a dynamically assigned person property. Because the payload is stored in the database, it is executed whenever another user views the affected person’s profile or accesses the printable view, which can enable session hijacking or full account compromise.

All installations of ChurchCRM running versions prior to 7.0.0 are affected, including those that applied the patch for CVE‑2023‑38766. The flaw resides in the PrintView.php component that renders person properties. Users with editing privileges on person records—typically church staff or administrators—can use the vulnerability, while unauthenticated users cannot inject code.

The CVSS score of 8.7 indicates high severity, yet the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Knock‑on risk remains because only authenticated users with access to person properties can disclose payloads, but given that this privilege is common among internal users, the threat surface is relatively high for organizations that do not restrict such access.