What’s Vulnerable › Vulnerabilities

CVE-2026-24855: ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-30 · updated 2026-06-17
• Weakness: CWE-79

Description

ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) vulnerability occurs in Create Events in Church Calendar. Users with low privileges can create XSS payloads in the Description field. This payload is stored in the database, and when other users view that event (including the admin), the payload is triggered, leading to account takeover. Version 6.7.2 fixes the vulnerability.

Affected products

• ChurchCRM CRM: before 6.7.2 — fixed in 6.7.2

How to fix

Upgrade to a fixed version: ChurchCRM CRM 6.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/commit/0cd0d211459b8c19509d36b3c1dfcd7f8c10d914
• https://github.com/ChurchCRM/CRM/commit/ec4b16e9a3ca09c8a01a712bcb90579c42f2ba28
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-49qp-cfqx-c767

Get alerted when CVE-2026-24855 or the next vulnerability affects your stack