XSS in Churchcrm Crm
CVE-2026-39941
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output en…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.001 (16.4th percentile) — read the EPSS interpretation.
Affected products
- Churchcrm Crm — versions < 7.1.0
Weakness classification (CWE)
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58 (x_refsource_CONFIRM)
- https://github.com/ChurchCRM/CRM/commit/d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98 (x_refsource_MISC)
- https://github.com/ChurchCRM/CRM/releases/tag/7.1.0 (x_refsource_MISC)