What is the CVSS score of CVE-2026-39332?

CVE-2026-39332 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39332?

ChurchCRM versions prior to 7.1.0 contain a reflected cross-site scripting (XSS) vulnerability in GeoPage.php that allows authenticated attackers to steal administrator session cookies and achieve…. A patch is available.

How to fix or mitigate CVE-2026-39332?

Within 24 hours: inventory all ChurchCRM deployments and identify current versions. Within 7 days: upgrade all ChurchCRM instances to version 7.1.0 or later; test functionality in staging environment before production deployment. Within 30 days: conduct security awareness training for administrative users on XSS-based social engineering attacks and suspicious form submission requests.

PHP CVE-2026-39332

EUVD-2026-19827 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

XSS PHP

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19827

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:37 nvd

HIGH 8.7

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.

AnalysisAI

Reflected XSS in ChurchCRM GeoPage.php enables authenticated attackers to execute arbitrary JavaScript in victims' browsers and hijack administrator sessions without user interaction. The vulnerability affects all versions prior to 7.1.0 and leverages autofocus to automatically trigger malicious payloads when authenticated users are socially engineered into submitting a crafted form. Session cookie theft leads to complete account takeover including administrative privileges. No public exploit identified at time of analysis, though technical details are available in the GitHub security advisory.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system designed for congregational administration. This vulnerability stems from improper neutralization of input during web page generation (CWE-79) in the GeoPage.php component. The application fails to adequately sanitize user-controlled input before reflecting it in HTML responses sent to authenticated users. The autofocus HTML attribute enables automatic JavaScript execution without requiring victim interaction beyond loading the page, transforming a typical reflected XSS requiring click-through into a more dangerous auto-executing variant. The affected product is identified by CPE cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, indicating the core ChurchCRM application across all vulnerable versions. The network-based attack vector with low complexity and changed scope in the CVSS vector indicates that successful exploitation affects resources beyond the vulnerable component's security scope, consistent with session hijacking scenarios where an attacker gains access to the victim's entire authenticated session.

RemediationAI

Upgrade ChurchCRM to version 7.1.0 or later, which contains the fix for this reflected XSS vulnerability. The vendor-released patch version 7.1.0 addresses the input sanitization flaw in GeoPage.php that enabled arbitrary JavaScript injection. Organizations should prioritize upgrading all ChurchCRM installations, particularly multi-user deployments where administrative accounts could be targeted. During the upgrade window, consider implementing additional controls such as restricting access to GeoPage.php to only trusted administrator accounts, deploying web application firewalls with XSS detection rules, or implementing Content Security Policy headers to mitigate script injection. Review authentication logs for suspicious form submission patterns that may indicate exploitation attempts. Detailed vulnerability information and upgrade guidance is available in the official GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc6g-h48v-wqvq. After upgrading, verify that input validation and output encoding are properly implemented in GeoPage.php and conduct testing to confirm the vulnerability has been remediated.