What is the CVSS score of CVE-2026-39333?

CVE-2026-39333 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-39333?

ChurchCRM versions before 7.1.0 contain a reflected XSS vulnerability in the FindFundRaiser.php endpoint that allows authenticated users to craft malicious URLs capable of hijacking sessions and…. A patch is available.

How to fix or mitigate CVE-2026-39333?

Within 24 hours: Identify all ChurchCRM instances and document current versions. Within 7 days: Upgrade all ChurchCRM installations to version 7.1.0 or later and verify the FindFundRaiser.php endpoint is updated. Within 30 days: Conduct a security audit of user access logs for the FindFundRaiser.php endpoint during the pre-patch period and implement URL input validation monitoring.

PHP CVE-2026-39333

EUVD-2026-19829 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

PHP XSS Churchcrm Crm

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:03 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19829

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:38 nvd

HIGH 8.7

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious URL that executes arbitrary JavaScript when visited by another authenticated user. This constitutes a reflected XSS vulnerability. This vulnerability is fixed in 7.1.0.

AnalysisAI

Reflected cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to execute arbitrary JavaScript in victims' browsers via crafted URLs targeting the FindFundRaiser.php endpoint. The vulnerability stems from improper output encoding of DateStart and DateEnd parameters in HTML attributes. CVSS 8.7 reflects the changed scope (S:C) enabling potential session hijacking and account compromise across the church management platform. No public exploit code or active exploitation (CISA KEV) identified at time of analysis, though exploitation probability remains moderate given the authenticated requirement and user interaction dependency.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system (CPE: cpe:2.3:a:churchcrm:crm). The vulnerability manifests in FindFundRaiser.php where user-supplied DateStart and DateEnd parameters are reflected into HTML input field attributes without context-appropriate output encoding. This represents CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw occurs specifically in the HTML attribute context, allowing attackers to break out of attribute delimiters and inject malicious JavaScript payloads. Proper defense requires HTML attribute encoding (converting quotes, angle brackets, and JavaScript event handlers) before reflection into DOM attributes. The vulnerability exists in the fundraiser search functionality, a component likely accessed by church administrators and financial management users.

RemediationAI

Vendor-released patch: ChurchCRM version 7.1.0 remediates this vulnerability through proper output encoding implementation for HTML attribute contexts. Organizations should upgrade to ChurchCRM 7.1.0 or later immediately. Consult the official GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fqq6-qrcf-h7h5 for specific upgrade instructions and release notes. As an interim mitigation where immediate patching is not feasible, implement Content Security Policy (CSP) headers to restrict inline script execution and configure web application firewalls (WAF) to detect and block XSS patterns in DateStart and DateEnd parameters. User awareness training should warn authenticated users against clicking untrusted links, particularly those containing fundraiser search parameters. However, these are defense-in-depth measures and do not substitute for upgrading to the patched version.