CVE-2025-68275CWE-79

ChurchCRM vulnerable to Stored XSS - Group name > Person Listing

Critical · published December 17, 2025

CVSS v4.0
9.2
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages `View Active People`, `View Inactive people`, and `View All People`. Version 6.5.3 fixes the issue.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00207 · 10.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-17T21:53Z
EPSS history
Timeline
  • 17 DEC 21:53Z
    ChurchCRM vulnerable to Stored XSS - Group name > Person Listing
    cvelistv5