Skip to content
OpenAdvisories

Vendor

ChurchCRM

76 known vulnerabilities.

Products

CRM 69 ChurchCRM 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-26059

    ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php

    ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.…

    ChurchCRM CRM
  • Low 2.0
    CVE-2025-68399

    ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php

    ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerability within the GroupEditor.php page of the application. When a user attempts to create a group role, they can execute mali…

    ChurchCRM CRM