Stored Cross Site Scripting Vulnerability in ChurchCRM by ChurchCRM

CVE-2025-0981

What is CVE-2025-0981?

A vulnerability in ChurchCRM versions 5.13.0 and earlier allows attackers to exploit a Stored Cross Site Scripting (XSS) flaw in the Group Editor page. By injecting malicious JavaScript, an attacker can capture the session cookie of authenticated users. This access enables session hijacking, allowing unauthorized users to impersonate legitimate users and potentially gain access to sensitive information. It is crucial for users of affected versions to apply security patches to mitigate these risks.

References