Medium severity6.1NVD Advisory· Published Apr 7, 2026· Updated Apr 9, 2026
CVE-2026-39335
CVE-2026-39335
Description
ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/ChurchCRM/CRM/security/advisories/GHSA-44j4-jjw2-wcr6nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.