ChurchCRM CVE-2026-58411

Exploitation requires that a victim with an active ChurchCRM session actively interacts with an attacker-supplied crafted link (UI:A in the CVSS vector), so it is not a fully autonomous remote attack; the attacker needs no prior authentication or privileges (PR:N) but does need to reach a victim and induce the click. The vulnerable reflection occurs specifically through request parameter names and parameter values sent to /FamilyCustomFieldsEditor.php, /PaddleNumList.php, or /admin/system/church-info on ChurchCRM instances prior to 7.4.0. Impact is greatest when the targeted user is an administrator, which enables privilege escalation and account takeover; limiting factors are the required user interaction, the need to social-engineer a logged-in victim, and that patched 7.4.0 instances are not vulnerable.

The provided CVSS 4.0 base score is 7.0 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N - network reachable, low complexity, no privileges, but requiring active user interaction, which is the key limiting factor for reflected XSS. No EPSS score, no CISA KEV listing, and no published proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is moderate and social-engineering-dependent: an attacker must lure an authenticated user (ideally an admin) into clicking a crafted URL. The VC:H rating reflects the plausible outcome of session/token theft leading to full account takeover if an administrator is targeted, which would escalate impact significantly. This is a legitimate patch-worthy issue but not a mass-exploitation, high-EPSS emergency; prioritize it above generic informational findings but below unauthenticated RCE.

An attacker crafts a URL to a vulnerable ChurchCRM endpoint (e.g., /admin/system/church-info) embedding a JavaScript payload in a parameter name or value, then emails it to a church administrator as a plausible link. When the authenticated admin opens it, the reflected script runs in their session context, exfiltrating their session token to the attacker and enabling account takeover. No public proof-of-concept was provided, but the low attack complexity means a working payload is straightforward to develop.