Skip to content
CVE PROGRAM SOURCE RECORD2.1 Low

CVE-2026-26059

ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php

Description

ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.8.2 fixes this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ChurchCRM CRM

  • < 6.8.1affected

References