Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M

CVE-2025-68399ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php

Low 2.0

In plain English

A low-severity cross-site scripting in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerability within the GroupEditor.php page of the application. When a user attempts to create a group role, they can execute malicious JavaScript. However, for this to work, the user must have permission to view and modify groups in the application. Version 6.5.4 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 6.5.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gfxf-w4cg-c54j x_refsource_CONFIRM