QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26059

Published: Feb 19, 2026

Modified: Feb 19, 2026

PUBLISHED

Description

ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.8.2 fixes this issue.

Vendor	Product	Versions
ChurchCRM	CRM	affected `< 6.8.1`

Weaknesses (CWE)

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3wp4-vpr7-47q6

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.