XSS in Churchcrm Crm

CVE-2026-39338

ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (17.3th percentile) — read the EPSS interpretation.

Affected products

Churchcrm Crm — versions < 7.1.0

Weakness classification (CWE)

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3ghg-qfqw-rcqf (x_refsource_CONFIRM)