What’s Vulnerable › Vulnerabilities

CVE-2026-39344: Reflected XSS the login page through the 'username' parameter

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-07 · updated 2026-07-24
• Weakness: CWE-79

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.

Affected products

• ChurchCRM CRM: before 7.1.0 — fixed in 7.1.0

How to fix

Upgrade to a fixed version: ChurchCRM CRM 7.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj

Get alerted when CVE-2026-39344 or the next vulnerability affects your stack