CVE-2026-39941

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.

Vulnerability Details

Published Date

April 09, 2026

Last Modified

April 14, 2026

CWE ID

CWE-79

Source

NVD

Vendor

ChurchCRM

Product

CRM

External References

https://github.com/ChurchCRM/CRM/commit/d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98
https://github.com/ChurchCRM/CRM/releases/tag/7.1.0
https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58

CVE-2026-39941

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment