Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39332 ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated use… https://www.cve.org/CVERecord?id=CVE-2026-39332
Post summary
The post announces a reflected XSS vulnerability in ChurchCRM’s GeoPage.php for versions below 7.1.0, with no mention of PoCs, exploits, patches, or active exploitation in the wild.
[CVE-2026-39332: HIGH] Critical security update in ChurchCRM's 7.1.0 release addresses a reflected XSS vulnerability, allowing attackers to steal session cookies and take over user accounts. Update now!#cve,CVE-2026-39332,#cybersecurity https://cvefind.com/CVE-2026-39332
Post summary
The tweet announces a critical update for ChurchCRM to address a reflected XSS flaw capable of session hijacking; no PoC, exploit tool, or active exploitation is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |