CVE-2023-26842

Deeper analysis

ChurchCRM version 4.5.3 contains a stored cross-site scripting vulnerability in OptionManager.php that permits remote attackers to inject arbitrary web scripts or HTML. The flaw is tracked as CVE-2023-26842 with a CVSS 3.1 score of 5.4, reflecting network attack vector, low complexity, low privileges required, and a requirement for user interaction that results in changed scope with limited confidentiality and integrity impact.

An authenticated attacker can supply malicious input through the affected component; once stored, the payload executes in the browsers of other users who view the tainted data, enabling actions such as session hijacking or unauthorized actions within the ChurchCRM application.

Public references consist of GitHub disclosure repositories that document the issue but do not detail official patches or mitigation steps from the vendor.

The associated EPSS score reached a peak of 0.1747 after starting from lower values, indicating that exploitation interest increased following public disclosure.