Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-39332: ChurchCRM lets attackers hijack user sessions
CVE-2026-39332 · published 7 months ago
Summary
Versions of ChurchCRM before 7.1.0 let a logged‑in user insert malicious code into a page that another logged‑in user might view. The code runs automatically and can steal the victim’s login cookies, giving the attacker full control of the account, even admin accounts. Upgrade to version 7.1.0 or later to stop this behavior.
What to do
- Update churchcrm churchcrm to version 7.1.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| churchcrm | churchcrm |
< 7.1.0 cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* |
Original advisory text
ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39332... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39332 Vendor Advisory
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc6g-h48v-wqvq Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published7 Apr 2026
Updated4 Nov 2026
First seen7 Apr 2026
Track software like this
Free during beta