Technical impact
The vulnerability allows an attacker to inject JavaScript or HTML attribute payloads into response pages because ChurchCRM fails to perform proper output encoding on request parameter names and values. The reflected input is incorporated into JavaScript string contexts and HTML attributes, enabling the malicious script to steal session tokens, hijack user accounts, and execute arbitrary actions on behalf of the authenticated user. Consequences include session token theft, account takeover, unauthorized data exposure, phishing, and privilege escalation against administrators.
Affected Systems
ChurchCRM Community Edition releases prior to version 7.4.0 are affected. The flaw appears in endpoints such as /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. All deployments running any earlier release are potentially vulnerable unless the affected endpoints have been removed or disabled.
Risk and Exploitability
The CVSS score of 7.0 indicates high severity, and the EPSS score is less than 1%, suggesting a low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a specially crafted HTTP request that places malicious content in parameter names or values. An attacker who can direct a victim to such a URL, for example via a phishing link or an injected form, can trigger the reflected XSS without needing higher privileges. While no publicly available exploit code is documented, the high severity and potential for account takeover or data exposure warrant remediation.
