CVE-2026-39336

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path where writable configuration fields are abused. This vulnerability is fixed in 7.1.0.

• CWE-79

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r8cp-gg58-2r2rThird Party Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39330ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39331ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39332ChurchCRM is an open-source church management system. Prior …8.7
• CVE-2026-39333ChurchCRM is an open-source church management system. Prior …8.7
• CVE-2026-39334ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39335ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39337ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-39338ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39339ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-3934Insufficient policy enforcement in ChromeDriver in Google Ch…6.5
• CVE-2026-39340ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39341ChurchCRM is an open-source church management system. Prior …8.1