CVE-2026-32880

CVE-2026-32880 describes a Cross-Site Scripting (XSS) vulnerability in ChurchCRM versions prior to 7.0.2, where an authenticated administrator can inject malicious JavaScript into JSON-type system settings. This medium-severity vulnerability (CVSS 6.4) requires high privileges and user interaction, allowing an attacker to execute arbitrary scripts in the context of another administrator's browser, potentially leading to high confidentiality and integrity impacts. While the attack vector is network-based with low complexity, it necessitates an existing administrative account. There is currently no evidence of active exploitation, nor are public exploit codes or significant community discussion available for this vulnerability. The issue has been addressed in ChurchCRM version 7.0.2.