Stored Cross-Site Scripting in ChurchCRM Affects User Profiles

CVE-2026-39328

What is CVE-2026-39328?

ChurchCRM, an open-source church management system, has a stored cross-site scripting vulnerability in its person profile editing feature. This issue allows non-administrative users with the EditSelf permission to inject malicious JavaScript into their social media profile fields—specifically Facebook, LinkedIn, and X. The vulnerability exploits a 50-character limit, distributing payloads across the three fields and chaining their onfocus event handlers. This means when other users, including administrators, view the compromised profile, their session cookies could be sent to a remote server. The issue has been addressed in version 7.1.0.

References