Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M
CVE-2026-39344Reflected XSS the login page through the 'username' parameter
High 8.1
In plain English
A high-severity cross-site scripting in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.
Affected products (as reported)
Weakness: CWE-80, CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj x_refsource_CONFIRM