An input validation flaw in ChurchCRM's EditEventAttendees.php allows attacker‑supplied values in the EName and EDesc parameters to be rendered without proper encoding. This flaw enables arbitrary JavaScript execution in the browsers of users who view the affected page, allowing a browser‑based attack that can steal session data, hijack accounts, or deliver additional malicious content. The weakness corresponds to the web cross‑site scripting categories CWE‑79 and CWE‑80.

This vulnerability affects the open‑source ChurchCRM platform in all versions earlier than 7.1.0. Any installation that has not applied the 7.1.0 release, which includes proper output encoding, remains vulnerable. No other vendors or products are listed as affected, so the impact is confined to ChurchCRM users.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score below 1% suggests a low likelihood of exploitation. The CVE description does not specify whether authentication is required or whether the attack vector is remote or local; this information is missing. Based on the description, it is inferred that an attacker could provide malicious payloads in the EName and EDesc parameters that would be executed when a victim’s browser renders the page. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly reported exploits at this time.