XSS in Churchcrm
CVE-2025-68401
ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/JS without sufficient sanitization/encoding. When other users later view this content, attacker-controlled JavaScript executes in their browser (stored XSS). In affected contexts the script can access web origin data and perform privileged actions as the victim. Where session cookies are not marked HttpOnly, the script can read document.cookie, enabling session theft and account takeover. Version 6.0.0 patches the issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (7.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Churchcrm
- Churchcrm Crm — versions < 6.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-68401?
- CVE-2025-68401 is a medium-severity vulnerability in Churchcrm, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2025-12-17.
- How severe is CVE-2025-68401?
- Medium severity. CVSS v3 base score is 4.8 out of 10.