CVE-2026-39328: ChurchCRM Stored XSS Vulnerability

CVE-2026-39328 Overview

CVE-2026-39328 is a stored cross-site scripting (XSS) vulnerability affecting ChurchCRM, an open-source church management system. The vulnerability exists in ChurchCRM's person profile editing functionality where non-administrative users with the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X (formerly Twitter) profile fields. Due to a 50-character field limit, attackers can distribute malicious payloads across all three social media fields and chain their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server, enabling session hijacking and account takeover.

Critical Impact

Stored XSS vulnerability allows low-privileged users to steal administrator session cookies and gain unauthorized access to the church management system, potentially compromising sensitive congregational data.

Affected Products

• ChurchCRM versions prior to 7.1.0

Discovery Timeline

• 2026-04-07 - CVE-2026-39328 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39328

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exploits insufficient input sanitization in ChurchCRM's profile editing feature. The attack leverages the social media profile fields (Facebook, LinkedIn, and X) which accept user input without proper encoding or validation of potentially malicious script content.

The vulnerability is particularly notable for its creative exploitation technique that overcomes the 50-character field limit by distributing the payload across three separate fields. When these fields are rendered on the profile page, their onfocus event handlers execute in sequence, effectively chaining the attack payload to bypass the character restriction.

The attack requires user interaction—specifically, an administrator or other user must view the malicious profile for the XSS payload to execute. Once triggered, the script exfiltrates session cookies to an attacker-controlled server, enabling session hijacking and potential full system compromise.

Root Cause

The root cause of CVE-2026-39328 is improper input validation and output encoding in ChurchCRM's profile editing functionality. The application fails to sanitize user-supplied input in the Facebook, LinkedIn, and X profile fields before storing it in the database and reflecting it back to other users viewing the profile. This allows JavaScript event handlers and malicious scripts to be stored and executed in the context of other users' browsers.

Attack Vector

The attack is network-based and requires low privileges—specifically the EditSelf permission commonly granted to regular church members. The attacker modifies their own profile's social media fields to include JavaScript event handlers. When the profile is viewed by any user, particularly administrators, the chained payload executes in the victim's browser context. The malicious script can then access the victim's session cookies and transmit them to an external server, allowing the attacker to impersonate the victim and gain their privilege level within the system.

The chained onfocus technique allows the attacker to execute payloads longer than the 50-character limit by splitting the JavaScript code across the Facebook, LinkedIn, and X fields and using event handlers to ensure sequential execution.

Detection Methods for CVE-2026-39328

Indicators of Compromise

• Unusual JavaScript content in user profile social media fields, particularly containing event handlers like onfocus, onerror, or onload
• Outbound HTTP/HTTPS connections to unknown external servers when viewing user profiles
• Profile fields containing encoded script payloads or references to external JavaScript files
• Unexpected modifications to user social media profile fields with non-URL content

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in HTTP POST requests to profile editing endpoints
• Monitor ChurchCRM database tables for social media profile fields containing suspicious patterns such as <script>, event handlers, or encoded payloads
• Enable Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Review web server access logs for unusual outbound requests originating from profile viewing activities

Monitoring Recommendations

• Deploy browser-based XSS detection extensions in administrator environments to alert on suspicious script execution
• Implement audit logging for all profile modifications, particularly changes to social media fields
• Configure network monitoring to detect cookie exfiltration attempts to external domains
• Establish baseline user activity patterns and alert on anomalous session behavior indicative of hijacking

How to Mitigate CVE-2026-39328

Immediate Actions Required

• Upgrade ChurchCRM to version 7.1.0 or later immediately
• Review all user profiles for suspicious content in social media fields and sanitize any malicious entries
• Rotate all user session tokens and force re-authentication across the system
• Implement Content Security Policy (CSP) headers to mitigate script execution from untrusted sources
• Temporarily restrict EditSelf permissions if immediate patching is not possible

Patch Information

The vulnerability is fixed in ChurchCRM version 7.1.0. Administrators should upgrade to this version or later to remediate CVE-2026-39328. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement server-side input validation to strip or encode HTML and JavaScript from social media profile fields
• Deploy a Web Application Firewall (WAF) with XSS filtering rules in front of the ChurchCRM application
• Restrict the EditSelf permission to trusted users only until patching is complete
• Enable HttpOnly and Secure flags on all session cookies to reduce the impact of cookie theft

# Apache Content Security Policy header configuration
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';"

# Nginx Content Security Policy header configuration
# Add to nginx.conf server block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';";