Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39328 ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functio… https://www.cve.org/CVERecord?id=CVE-2026-39328
Post summary
The post discloses a stored XSS flaw in ChurchCRM before version 7.1.0, but offers no PoC, exploit, patch, or evidence of active exploitation.
[CVE-2026-39328: HIGH] A recent vulnerability in ChurchCRM's management system allowed cross-site scripting via profile fields, exposing user sessions. Ensure ChurchCRM systems are updated to version 7.1.0.#cve,CVE-2026-39328,#cybersecurity https://cvefind.com/CVE-2026-39328
Post summary
The post discloses a high‑severity XSS vulnerability in ChurchCRM and urges users to update to version 7.1.0 to remediate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |