CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or contextual output encoding. Affected endpoints observed during testing: /FamilyCustomFieldsEditor.php, /PaddleNumList.php and /admin/system/church-info. Potential consequences include session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. This issue has been resolved in version 7.4.0.

• CWE-79

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p6j6-vrpg-4pp8
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p6j6-vrpg-4pp8

Published

Jul 13, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58404Hugo is a static site generator. From v0.162.0 through v0.16…6.8
• CVE-2026-58407Rejected reason: Please submit CVE requests for each vulnera…
• CVE-2026-58408ChurchCRM is an open-source church management system. Prior …6.5
• CVE-2026-58409ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-5841A weakness has been identified in Tenda i3 1.0.0.6(2204). Th…9.8
• CVE-2026-58410ChurchCRM is an open-source church management system. Prior …7.1
• CVE-2026-58413Network-AI is a TypeScript/Node.js multi-agent orchestrator.…6.1
• CVE-2026-58414Network-AI is a TypeScript/Node.js multi-agent orchestrator.…5.5
• CVE-2026-58418SSRF via HTTP Redirect in Repository Migration6.5
• CVE-2026-58419Notification API leaks private issue metadata after access r…7.5
• CVE-2026-5842A security vulnerability has been detected in decolua 9route…7.3
• CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows…7.5