CVE-2026-39328

{
  "id": "CVE-2026-39328",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T18:16:44.043",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0."
    },
    {
      "lang": "es",
      "value": "ChurchCRM es un sistema de gestión de iglesias de código abierto. Antes de la versión 7.1.0, existe una vulnerabilidad de cross-site scripting almacenado en la funcionalidad de edición de perfiles de persona de ChurchCRM. Los usuarios no administrativos que tienen el permiso EditSelf pueden inyectar JavaScript malicioso en sus campos de perfil de Facebook, LinkedIn y X. Debido a un límite de campo de 50 caracteres, la carga útil se distribuye entre los tres campos y encadena sus manejadores de eventos onfocus para ejecutarse en secuencia. Cuando cualquier usuario, incluidos los administradores, ve el perfil del atacante, sus cookies de sesión son exfiltradas a un servidor remoto. Esta vulnerabilidad se corrige en la versión 7.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ChurchCRM",
          "product": "CRM",
          "versions": [
            {
              "version": "< 7.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T15:49:46.149377Z",
          "id": "CVE-2026-39328",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "7.1.0",
              "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}