← Vulnerability feed

Vulnerability record · CVE-2026-39338 · published 7 April 2026

CVE-2026-39338: Churchcrm cross-site scripting vulnerability

Churchcrm · Churchcrm

ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prior to rendering it within the browser's DOM. Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned — resulting in successful code execution regardless of the server-side error. This vulnerability is fixed in 7.1.0.

8.6 CVSS 4.0 High EPSS 0.32% · top 77.2% CWE-79 · Cross-site scriptingCWE-1004 · CWE-1004
8.6CVSS 4.0 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prior to rendering it within the browser's DOM. Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned — resulting in successful code execution regardless of the server-side error. This vulnerability is fixed in 7.1.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3ghg-qfqw-rcqf ExploitVendor Advisory

Track CVE-2026-39338 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-39337Churchcrm code injection vulnerabilityChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's …EPSS 1.1%9.8CVE-2025-62521Churchcrm code injection vulnerabilityChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM'…EPSS 4.5%9.8CVE-2024-53438Churchcrm sql injection vulnerabilityEventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' paramet…EPSS 0.55%9.8CVE-2024-25894Churchcrm sql injection vulnerabilityChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.EPSS 0.65%9.8CVE-2024-25897Churchcrm sql injection vulnerabilityChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.EPSS 1.6%9.4CVE-2026-39342Churchcrm sql injection vulnerabilityChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to…EPSS 0.46%9.3CVE-2025-68400Churchcrm sql injection vulnerabilityChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` i…EPSS 0.38%9.3CVE-2025-67876Churchcrm cross-site scripting vulnerabilityChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior …EPSS 0.20%

Source: NIST National Vulnerability Database (record CVE-2026-39338), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.