CVE-2026-32880 — ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php
ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execut…
Published: 2026-03-20 · CVSS: 6.4 · CVSS 3.1
ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading to XSS. This issue has been fixed in version 7.0.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7