Is there a patch available for CVE-2026-39941?

Yes, a patch is available for CVE-2026-39941. Update the affected software to the latest version immediately.

PHP CVE-2026-39941

Q: What is the CVSS score of CVE-2026-39941?

CVE-2026-39941 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20948 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 GitHub_M

XSS PHP

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 09, 2026 - 16:00 euvd

EUVD-2026-20948

Analysis Generated

Apr 09, 2026 - 16:00 vuln.today

CVE Published

Apr 09, 2026 - 15:38 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.

AnalysisAI

Cross-site scripting (XSS) in ChurchCRM prior to 7.1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript through the EName and EDesc parameters in EditEventAttendees.php, which is rendered without proper output encoding. Successful exploitation requires user interaction (UI:P) and results in session hijacking, credential theft, or malware distribution to victims' browsers. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management system (CPE: cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*) that handles event attendance management. The vulnerability is a classic reflected or stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) in the EditEventAttendees.php script. The EName and EDesc parameters are incorporated into the HTML response without sanitization or proper output encoding (e.g., htmlspecialchars, context-aware escaping). Because the application is PHP-based and the vulnerable endpoint accepts user-supplied input parameters, attackers can craft malicious URLs or form submissions containing JavaScript payloads that execute in victims' browsers when the page is rendered.

RemediationAI

Vendor-released patch: ChurchCRM 7.1.0. Upgrade immediately from any prior version to 7.1.0 or later. The fix is available at https://github.com/ChurchCRM/CRM/releases/tag/7.1.0. The underlying code changes are documented in commit d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98 (https://github.com/ChurchCRM/CRM/commit/d2f7f36e2ea342419026ddc4bc4ea8efbf5e7e98), which implements proper output encoding for the EName and EDesc parameters. If immediate patching is not possible, restrict access to the EditEventAttendees.php endpoint via web application firewall rules or network access controls, and disable event attendance editing features until patching is complete. Security advisory: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58.