CVE-2026-39335
- Source
- https://cve.org/CVERecord?id=CVE-2026-39335
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39335.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-39335
- Aliases
-
- GHSA-44j4-jjw2-wcr6
- Published
- 2026-04-07T17:23:08Z
- Modified
- 2026-08-12T03:51:38Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls
- Details
-
ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39335.json" }- References
Affected packages
Git / github.com/churchcrm/crm
Affected ranges
- Type
- GIT
- Repo
- https://github.com/churchcrm/crm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "7.1.1" }, { "last_affected": "7.1.1" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }
Affected versions
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.0-RC1
2.8.0-RC2
2.8.1
2.8.10
2.8.11
2.8.12
2.8.13
2.8.14
2.8.15
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.9.0
2.9.0-RC1
2.9.1
2.9.2
2.9.3
2.9.4
3.*
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.8
3.0.9
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.4.0
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
5.*
5.0.0
5.0.0-beta1
5.0.0-beta2
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.10.0
5.11.0
5.13.0
5.14.0
5.15.0
5.16.0
5.17.0
5.18.0
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.21.0
5.22.0
5.3.0
5.3.1
5.4.0
5.4.1
5.4.3
5.5.0
5.6.0
5.7.0
5.8.0
5.9.1
5.9.2
5.9.3
6.*
6.0.0
6.0.1
6.0.2
6.1.0
6.2.0
6.3.0
6.4.0
6.5.0
6.5.1
6.5.2
6.5.3
6.6.0
6.6.1
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.1.0
7.1.0-rc1
7.1.0-rc2
7.1.0-rc3