CVE-2026-39338

BRIEFING NOTE CVE-2026-39338 is a Blind Reflected Cross-Site Scripting (XSS) vulnerability in ChurchCRM, an open-source church management system, affecting all versions prior to 7.1.0. The vulnerability exists in the dashboard search parameter, where the application fails to properly sanitize or encode user-supplied input before rendering it in the browser's DOM. Notably, the vulnerability results in successful JavaScript code execution even though the server returns an HTTP 500 error, as the browser parses and executes injected script tags before the error response is delivered. The vulnerability has a CVSS 3.1 score of 6.1 (MEDIUM severity) with a network-based attack vector requiring no privileges but user interaction. The attack has low complexity and low computational overhead, with potential impacts limited to confidentiality and integrity breaches while availability remains unaffected. The EPSS score of 0.00037 indicates this vulnerability is less prevalent in active exploitation compared to similar CVEs. There are no indicators of active exploitation at this time. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal with no publicly available exploit code currently documented. Organizations running ChurchCRM should prioritize upgrading to version 7.1.0 or later to remediate this XSS vulnerability, particularly if the affected systems accept untrusted search input from external users.