CVE-2026-39941

ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.

• CWE-79
• CWE-80

• https://github.com/ChurchCRM/CRM/commit/d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98Patch
• https://github.com/ChurchCRM/CRM/releases/tag/7.1.0Product, Release Notes
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58Exploit, Vendor Advisory
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58Exploit, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39935Improper neutralization of input during web page generation …6.9
• CVE-2026-39936Improper neutralization of input during web page generation …6.9
• CVE-2026-39937Improper removal of sensitive information before storage or …8.8
• CVE-2026-39938Cacti is an open source performance and fault management fra…9.8
• CVE-2026-3994A vulnerability was detected in rui314 mold up to 2.40.4. Th…5.3
• CVE-2026-39940ChurchCRM is an open-source church management system. Prior …5.3
• CVE-2026-39942Directus is a real-time API and App dashboard for managing S…8.8
• CVE-2026-39943Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2026-39944Ceph is an open-source distributed storage platform providin…8.8
• CVE-2026-39946OpenBao is an open source identity-based secrets management …4.9
• CVE-2026-39948Cacti is an open source performance and fault management fra…9.8
• CVE-2026-3995The OPEN-BRAIN plugin for WordPress is vulnerable to Stored …4.4