CVE-2026-39328

OVERVIEW CVE-2026-39328 is a stored cross-site scripting (XSS) vulnerability in ChurchCRM, an open-source church management system, affecting versions prior to 7.1.0. The vulnerability exists in the person profile editing functionality where non-administrative users with EditSelf permission can inject malicious JavaScript into social media profile fields (Facebook, LinkedIn, and X). Due to a 50-character field limit per field, attackers distribute their payload across multiple fields and chain onfocus event handlers to execute sequentially. SEVERITY The vulnerability carries a CVSS score of 8.9 (HIGH) with a network-based attack vector, low attack complexity, and low privilege requirements. Exploitation requires user interaction, though the scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component. The impact is severe, including high confidentiality and integrity compromise, with session cookie exfiltration to attacker-controlled servers when any user, including administrators, views the malicious profile. EXPLOITATION STATUS There is currently no indication of active exploitation in the wild, with no known exploit code publicly available and the vulnerability not appearing on the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.00041 indicates minimal real-world exploitation activity. However, community attention appears limited, and organizations running ChurchCRM versions prior to 7.1.0 should prioritize upgrading to remediate this risk before exploitation becomes practical.