CVE-2026-39332CWE-79

ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php

High · published April 7, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00357 · 28.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-07T17:37Z
EPSS history
Timeline
  • 07 APR 17:37Z
    ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
    cvelistv5