The vulnerability allows a malicious actor who possesses legitimate user credentials to create a specially crafted URL that injects arbitrary JavaScript into an HTML input field attribute on the FindFundRaiser.php page. When the target authenticated user visits the URL, the injected code runs in the browser’s context. This can lead to session hijacking, theft of credentials, or further malicious actions performed with the victim’s privileges.

ChurchCRM, a public‑source church management system, is affected in all releases older than version 7.1.0. The flaw is confined to the FindFundRaiser.php endpoint and requires that the attacker be authenticated to an account within the system.

The CVSS score of 8.7 reflects a high impact, while the EPSS score of less than 1% indicates that the vulnerability is currently low probability of exploitation. Because the bug requires authenticated access, the attacker must either compromise user credentials or compromise an already authenticated session, limiting the threat to internal users or attackers who can gain credentials. The vulnerability is not listed in the CISA KEV catalog, and there is no publicly available exploit, though the attack path is straightforward via a user‑directed URL.