Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M
CVE-2025-67876ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
Critical 9.3
In plain English
A critical-severity cross-site scripting in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover. As of time of publication, no known patched versions are available.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j9gv-26c7-3qrh x_refsource_CONFIRM