PT-2026-31644 · Churchcrm · Churchcrm

Loociprian · CVE-2026-39941 · Published 2026-04-09 · Updated 2026-04-09

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description ChurchCRM, an open-source church management system, contains a cross-site scripting (XSS) issue. Input provided through the EName and EDesc parameters in the EditEventAttendees.php file can be rendered without proper encoding, allowing for the execution of arbitrary JavaScript code in a victim's browser.

Recommendations Update to version 7.1.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-39941

GHSA-4MQW-9JWW-2C58

Affected Products

Churchcrm

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39941.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58 · Exploit
• https://github.com/ChurchCRM/CRM/commit/d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98 · Patch
• https://osv.dev/vulnerability/CVE-2026-39941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39941 · Security Note
• https://github.com/ChurchCRM/CRM/releases/tag/7.1.0 · Note
• https://twitter.com/VulmonFeeds/status/2042287861202899006 · Twitter Post
• https://twitter.com/CVEnew/status/2042302809354486201 · Twitter Post