ChurchCRM’s GeoPage.php has a reflected cross‑site scripting flaw that allows an authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. The injected code automatically executes via autofocus without user interaction, enabling the attacker to steal session cookies and assume control of the victim’s account, including administrative privileges.

The vulnerable product is ChurchCRM:CRM. All installations running any version earlier than 7.1.0 are susceptible; versions 7.1.0 and newer contain the fix.

The CVSS base score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low historical exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Two conditions are required for exploitation: the attacker must be authenticated and submit a crafted form; once done, the payload auto‑executes. The likely attack vector is authenticated web requests directed at GeoPage.php. Prompt remediation is recommended to prevent account takeover.