CVE-2026-32880: ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript…

PriorityP431medium6.4CVSS 3.1

AVNACLPRHUIRSUCHIHAL

EPSS

0.32%

23.7th percentile

ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading to XSS. This issue has been fixed in version 7.0.2.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
churchcrm	churchcrm	< 7.0.2	7.0.2
churchcrm	crm	< 7.0.2	7.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.