Executive Summary

CVE-2026-39335 is a stored cross-site scripting (XSS) vulnerability in ChurchCRM versions up to 7.0.5, fixed in 7.1.1. It occurs because user-supplied data is inserted into HTML attribute contexts without proper escaping, allowing malicious scripts to be stored and executed later.

Specifically, the vulnerability affects the group remove control and family editor state/country fields, where input filtering is done during data writing but output rendering lacks proper attribute-context encoding. This lets an authenticated administrator inject malicious payloads into group names or family attributes.

When another administrator interacts with these affected pages, the injected script executes, leading to stored XSS attacks within privileged admin sessions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrator privileges to inject malicious scripts that execute in the context of other administrators' sessions.

• Execution of arbitrary scripts within privileged admin sessions.
• Potential compromise of confidentiality and integrity of sensitive data.
• An attacker can exploit this to steal cookies, perform unauthorized actions, or manipulate data.

The attack requires high privileges and user interaction but has low complexity and can be triggered over the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious scripts injected into the group remove control and family editor state/country fields within ChurchCRM versions up to 7.0.5. Since the exploit involves injecting payloads into data-* attributes that execute when an admin interacts with the affected pages, detection involves inspecting these fields for suspicious attribute values.

Specifically, you can review the database entries for group names and family attributes for suspicious strings such as payloads containing event handlers like "autofocus onfocus=alert(document.cookie) x=" or other unexpected HTML attribute injections.

There are no explicit commands provided in the resources, but general detection steps include:

• Query the database tables that store group names and family editor fields to look for suspicious patterns or scripts.
• Use web application scanning tools that can detect stored XSS by simulating input of malicious payloads and observing if they are executed in the admin interface.
• Manually inspect the affected pages (group remove control and family editor) in the admin interface for unexpected script execution or unusual behavior.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows stored cross-site scripting (XSS) attacks that can lead to high confidentiality and integrity impacts within privileged admin sessions.

Such impacts could potentially affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining data integrity.

However, the provided information does not explicitly discuss or analyze the direct effects of this vulnerability on compliance with these or other common standards and regulations.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation is to upgrade ChurchCRM to version 7.1.1 or later, where this stored XSS vulnerability has been fixed.

Until the upgrade can be performed, restrict administrative access to trusted users only, as the vulnerability requires high privileges and user interaction by an admin.

Additionally, review and sanitize existing group names and family editor fields in the database to remove any injected malicious scripts.

Implement monitoring for suspicious admin activities and consider applying web application firewall (WAF) rules to detect and block attempts to inject malicious payloads into these fields.

Useful 0 Not Useful 0