Which versions of ChurchCRM are affected by CVE-2026-58411?

ChurchCRM deployments running versions before 7.4.0 are vulnerable to cross-site scripting attacks that can compromise administrator accounts and expose sensitive member data.

How to fix or mitigate CVE-2026-58411?

Within 24 hours, identify all ChurchCRM deployments running versions before 7.4.0 and notify administrative staff of the vulnerability, instructing them to avoid clicking suspicious links and remain cautious with external communications. Within 7 days, deploy a Web Application Firewall (WAF) with XSS protection rules on all ChurchCRM instances and restrict administrator access to trusted networks via IP allowlisting or VPN. Within 30 days, establish a formal upgrade plan to ChurchCRM 7.4.0 or later, execute the upgrade on a documented timeline, and conduct a security audit of administrator account access logs to identify any unauthorized activity since discovery.

ChurchCRM CVE-2026-58411

Q: What is the CVSS score of CVE-2026-58411?

CVE-2026-58411 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 GitHub_M

PHP XSS Privilege Escalation Churchcrm Crm

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Reflected XSS is network-reachable with no privileges but needs victim interaction (UI:R); script runs in the victim's browser context (S:C) with limited confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:47 vuln.today

CVE Published

Jul 13, 2026 - 21:05 cve.org

HIGH 7.0

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or contextual output encoding. Affected endpoints observed during testing: /FamilyCustomFieldsEditor.php, /PaddleNumList.php and /admin/system/church-info. Potential consequences include session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. This issue has been resolved in version 7.4.0.

AnalysisAI

Reflected Cross-Site Scripting in ChurchCRM before 7.4.0 lets remote attackers inject JavaScript through unsanitized request parameter names and values reflected into JavaScript-string and HTML-attribute contexts on endpoints such as /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. When a victim (especially an administrator) follows a crafted link, the payload executes in their session, enabling session-token theft, account takeover, and exposure of church member data. No public exploit identified at time of analysis, and the CVSS 4.0 vector (PR:N/UI:A) indicates unauthenticated triggering but requires victim interaction.

Technical ContextAI

ChurchCRM is a PHP-based open-source church management platform for tracking members, families, donations, and administrative records. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: user-controlled input - notably HTTP request parameter names as well as their values - is echoed back into rendered pages without contextual output encoding. Because the reflection occurs in two distinct sink contexts (inside JavaScript string literals and inside HTML attribute values), a single encoding scheme is insufficient; each context requires its own escaping (JS-string escaping vs. HTML-attribute escaping). The CPE cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:* confirms the ChurchCRM 'crm' application as the affected product across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade to ChurchCRM 7.4.0 or later, which resolves the insufficient output encoding, per the advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p6j6-vrpg-4pp8. If you cannot upgrade immediately, place the application behind a WAF with rules to block reflected script payloads in query parameters, and specifically restrict or monitor access to the affected endpoints /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info (note this may break legitimate custom-field editing and admin church-info workflows). Deploy a strict Content-Security-Policy that disallows inline script execution to blunt payload execution (side effect: may break in-app inline scripts and require testing), enable HttpOnly and Secure flags on session cookies to limit token theft via document.cookie, and instruct administrators not to follow untrusted links into the ChurchCRM instance until patched.