CVE-2026-39333 - Vulnerability Analysis

Overview

ChurchCRM < 7.1.0 contains a reflected XSS caused by improper output encoding of DateStart and DateEnd parameters in FindFundRaiser.php, letting authenticated attackers execute arbitrary JavaScript via crafted URLs.

Severity & Score

Impact

Authenticated attackers can execute arbitrary JavaScript in other users' browsers, potentially stealing session data or performing actions on their behalf.

Mitigation

Update to version 7.1.0 or later.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fqq6-qrcf-h7h5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 8, 2026

🟠 CVE-2026-39333 - High (8.7) ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML input field attributes without proper output encoding for the HTML attribute contex... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39333/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner