What is the CVSS score of EUVD-2026-19718?

EUVD-2026-19718 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-19718?

ChurchCRM versions before 7.1.0 contain a stored cross-site scripting vulnerability that allows authenticated users with EditRecords role to inject malicious code through Facebook profile fields,…. A patch is available.

How to fix or mitigate EUVD-2026-19718?

Within 24 hours: Identify all ChurchCRM installations and document current versions. Within 7 days: Upgrade all ChurchCRM instances to version 7.1.0 or later; restrict EditRecords role assignment to trusted personnel only as interim control. Within 30 days: Conduct security awareness training for users with EditRecords role on avoiding malicious profile data input; implement access logging review for administrative accounts created or modified in the past 90 days.

PHP EUVD-2026-19718

| CVE-2026-35534 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

XSS PHP

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19718

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:47 nvd

HIGH 7.6

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText() as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote characters allowing an attacker to break out of the href attribute and inject arbitrary JavaScript event handlers. Any authenticated user with the EditRecords role can store the payload in a person's Facebook field. The XSS fires against any user who views that person's profile page, including administrators, enabling session hijacking and full account takeover. This vulnerability is fixed in 7.1.0.

AnalysisAI

Stored cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 enables authenticated users with EditRecords role to inject malicious JavaScript through improperly sanitized Facebook profile fields, executing arbitrary code in administrators' browser sessions and enabling account takeover. The vulnerability exploits inadequate output encoding in PersonView.php where sanitizeText() strips HTML tags but fails to escape quote characters in href attribute contexts. EPSS data not available; no CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the technical barrier is low (CVSS AC:L) for authenticated attackers.

Technical ContextAI

The vulnerability resides in ChurchCRM's PersonView.php component, which renders user profile information including social media fields. The application incorrectly applies sanitizeText() as an output sanitizer for HTML attribute contexts, specifically within href attributes for the Facebook profile field. While sanitizeText() performs HTML tag stripping to prevent direct tag injection, it does not implement proper output encoding for attribute contexts-critically failing to escape quote characters (single/double quotes). This allows an attacker to terminate the href attribute value prematurely and inject additional HTML attributes containing JavaScript event handlers (e.g., onmouseover, onerror). The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an output encoding failure. The affected product is identified as cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, indicating the ChurchCRM application across all versions prior to the fix. This is a classic stored XSS vulnerability where malicious payloads persist in the database and execute in victims' browsers during normal application use.

RemediationAI

Upgrade immediately to ChurchCRM version 7.1.0, which implements proper output encoding for HTML attribute contexts and resolves the improper use of sanitizeText() in PersonView.php. The vendor-released patch is available through standard ChurchCRM update channels and the project's GitHub repository. Organizations should prioritize this upgrade for production instances, particularly those accessible to external users or containing sensitive congregation data. As an interim mitigation where immediate patching is not feasible, administrators can restrict the EditRecords role to only highly trusted users and implement enhanced monitoring of profile field modifications, though these controls do not eliminate the underlying vulnerability. Review audit logs for suspicious modifications to Facebook fields in person records, looking for patterns consistent with XSS payload injection (presence of quote characters, JavaScript event handlers, or encoded characters). After patching, sanitize existing Facebook field values in the database to remove any stored malicious payloads that may have been injected prior to upgrade. Complete remediation guidance and patch details are available in the GitHub security advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqp6-54p2-m66f.