ChurchCRM, before version 7.1.0, contains a blind reflected cross‑site scripting flaw in the dashboard search input. The application does not sanitize or encode user‑supplied data before inserting it into the DOM. When a malicious payload is supplied, the server returns an HTTP 500 error, but the browser's JavaScript engine parses the injected <script> tags before the error response returns, allowing arbitrary code to run in the victim's browser. Because the code executes in the context of the logged‑in administrator, scripts can read cookies and other session tokens, leading to credential theft and potential full administrative takeover.

Vendor: ChurchCRM. Product: ChurchCRM CRM. Version: Prior to 7.1.0. No other version data is listed.

CVSS score is 8.6, indicating a high severity. The EPSS score is not available. It is not listed in KEV. The vulnerability can be exploited by sending a crafted search query containing a malicious script via the web interface. The attacker does not need special privileges and only requires that a victim with administrative access visits the injected link. If successful, arbitrary JavaScript runs with the administrator's privileges, enabling cookie theft, session hijacking, or further payload execution. Because it is a blind XSS, impact is not immediately visible to the victim, reducing detection chances.