What is the CVSS score of EUVD-2026-19849?

EUVD-2026-19849 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Churchcrm are affected by EUVD-2026-19849?

ChurchCRM versions prior to 7.1.0 contain a reflected cross-site scripting vulnerability in the login page that allows unauthenticated attackers to execute malicious scripts in user browsers via…. A patch is available.

How to fix or mitigate EUVD-2026-19849?

Within 24 hours: Inventory all ChurchCRM deployments and document current versions. Within 7 days: Upgrade all ChurchCRM instances to version 7.1.0 or later per vendor advisory. Within 30 days: Conduct security awareness training for staff on recognizing suspicious login URLs and verify no unauthorized access occurred during the remediation window.

Churchcrm EUVD-2026-19849

| CVE-2026-39344 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 security-advisories@github.com

XSS Information Disclosure Churchcrm

8.1

CVSS 3.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1.0

EUVD ID Assigned

Apr 07, 2026 - 18:22 euvd

EUVD-2026-19849

Analysis Generated

Apr 07, 2026 - 18:22 vuln.today

CVE Published

Apr 07, 2026 - 18:16 nvd

HIGH 8.1

DescriptionCVE.org

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in ChurchCRM login page allows remote attackers to execute arbitrary JavaScript in victims' browsers through malicious URLs containing unsanitized username parameters. ChurchCRM versions prior to 7.1.0 fail to encode the username parameter, enabling attackers to craft URLs that inject malicious scripts capable of stealing session cookies or displaying phishing forms. With CVSS 8.1 (AV:N/AC:L/PR:N/UI:R) and no public exploit identified at time of analysis, this represents a moderate-priority risk requiring user interaction but no authentication for exploitation.

Technical ContextAI

ChurchCRM is an open-source church management system built on PHP/MySQL for congregational administration. This vulnerability stems from improper input validation (CWE-79: Improper Neutralization of Input During Web Page Generation) in the login page authentication flow. The application directly reflects URL-supplied username parameters into HTML input elements without sanitization, encoding, or Content Security Policy protection. When a victim clicks a crafted link containing JavaScript in the username parameter, the malicious code executes within the application's security context. This is a classic reflected XSS pattern where attacker-controlled data flows from HTTP request parameters directly into the HTML response without validation, enabling DOM manipulation, credential harvesting through fake login forms, or session hijacking via cookie exfiltration.

RemediationAI

Upgrade ChurchCRM to version 7.1.0 or later, which includes input sanitization and proper output encoding for the username parameter on the login page. Administrators should verify their current version by checking the application footer or configuration files, then follow standard upgrade procedures documented in the ChurchCRM installation guide. During the upgrade window, organizations can implement temporary mitigations including Web Application Firewall rules to detect and block common XSS patterns in URL parameters, Content Security Policy headers restricting inline script execution, and user awareness training to avoid clicking untrusted links to the login page. The complete fix details and upgrade instructions are available in the GitHub Security Advisory at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj. Organizations unable to immediately upgrade should consider restricting login page access to trusted networks via firewall rules or VPN requirements until patching is completed.