CVE-2025-67875 ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
Authenticated users can inject persistent XSS into admin profiles via property assignment, leading to session hijacking and full account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-67875?
CVE-2025-67875 is a high-severity cross-site scripting vulnerability in Churchcrm Churchcrm, published on 17 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-67875?
It affects 1 product.
Products include Churchcrm Churchcrm.
How do I fix CVE-2025-67875?
No fix has been published for CVE-2025-67875 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-67875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67875 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Churchcrm Churchcrm
Sources
Also known as GHSA-fcw7-mmfh-7vjm.