What is the CVSS score of CVE-2026-32880?

CVE-2026-32880 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-32880?

Organizations using ChurchCRM should be aware of moderate risk from CVE-2026-32880, a cross-site scripting vulnerability rated CVSS 6.4.. A patch is available.

How to fix or mitigate CVE-2026-32880?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-32880

EUVD-2026-13429 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 security-advisories@github.com

PHP XSS

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.0.2

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13429

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

MEDIUM 6.4

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading to XSS. This issue has been fixed in version 7.0.2.

AnalysisAI

ChurchCRM versions prior to 7.0.2 contain a stored cross-site scripting (XSS) vulnerability in the system settings module where administrative users can inject unescaped JavaScript payloads into JSON-type system settings fields. Any administrator who subsequently views the system settings page will execute the attacker's malicious script, potentially allowing credential theft, session hijacking, or lateral movement within the church organization's administrative infrastructure. The vulnerability has been patched in version 7.0.2, and no evidence of active exploitation in the wild has been reported, though the attack requires only high-level privileges (admin access) and basic user interaction (viewing settings).

Technical ContextAI

The vulnerability exists in ChurchCRM's SystemSettings.php file, which processes JSON-type configuration parameters without proper input sanitization or output encoding. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data is stored in a database and later rendered in an HTML context without escaping. The root cause stems from insufficient validation when JSON settings are deserialized and re-rendered in the administrative interface—the system treats JSON values as trusted data rather than potentially hostile user input. The affected product is identified by CPE references to ChurchCRM versions below 7.0.2, with the vulnerability specifically affecting the PHP-based settings management component that handles system configuration for church administrative users.

RemediationAI

Immediately upgrade ChurchCRM to version 7.0.2 or later, which addresses the input sanitization flaw in SystemSettings.php (see https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7gq6-xmpx-qc7c for detailed patch notes). For organizations unable to patch immediately, implement access controls by restricting the 'System Settings' administrative function to a minimal set of trusted administrators, conduct a review of existing system settings JSON for suspicious JavaScript patterns, and monitor administrator activity logs for unauthorized settings modifications. Additionally, apply output encoding at the application layer (HTML entity encoding) as a temporary defense-in-depth measure until patching is complete. No known workarounds exist short of restricting administrative access.