CVE-2026-58411: ChurchCRM XSS Vulnerability

CVE-2026-58411 Overview

CVE-2026-58411 is a Cross-Site Scripting (XSS) vulnerability affecting ChurchCRM, an open-source church management system. Versions prior to 7.4.0 fail to apply proper output encoding to user-controlled request parameter names and values. The application reflects attacker-controlled input directly into JavaScript string contexts and HTML attribute contexts. Affected endpoints include /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. The issue is tracked under [CWE-79] and has been fixed in version 7.4.0.

Critical Impact
Successful exploitation enables session-token theft, account takeover, credential harvesting, and privilege escalation when administrator users are targeted.

Affected Products

ChurchCRM versions prior to 7.4.0
Endpoint: /FamilyCustomFieldsEditor.php
Endpoint: /PaddleNumList.php
Endpoint: /admin/system/church-info

Discovery Timeline

2026-07-13 - CVE-2026-58411 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58411

Vulnerability Analysis

The vulnerability stems from insufficient output encoding across multiple ChurchCRM endpoints. The application reflects attacker-controlled request parameter names and values into two distinct sink contexts: JavaScript string literals and HTML attribute values. Neither sink applies contextual output encoding appropriate for the destination.

When input reaches a JavaScript string context, attackers can break out of the string literal and inject arbitrary script. When input reaches an HTML attribute context, attackers can close the attribute and introduce new event handlers such as onerror or onload. The reflected nature of the flaw means exploitation requires user interaction, typically via a crafted link delivered through phishing.

Because ChurchCRM holds sensitive membership data and administrative functionality, targeted attacks against authenticated administrators are the highest-impact scenario. Refer to the GitHub Security Advisory GHSA-p6j6-vrpg-4pp8 for full technical details.

Root Cause

The root cause is missing contextual output encoding on parameter names and values before they are rendered in server responses. The affected pages concatenate request input into JavaScript and HTML attribute contexts without escaping characters such as <, >, ", ', and backslash sequences meaningful to each context.

Attack Vector

An attacker crafts a URL targeting /FamilyCustomFieldsEditor.php, /PaddleNumList.php, or /admin/system/church-info with malicious payloads in request parameters. The victim, who must be authenticated to ChurchCRM, follows the link. The server reflects the payload into the response, and the browser executes the injected script in the origin of the ChurchCRM instance. Payloads can exfiltrate session cookies, perform state-changing actions using the victim's privileges, or harvest credentials via injected forms.

Detection Methods for CVE-2026-58411

Indicators of Compromise

Web server access logs containing requests to /FamilyCustomFieldsEditor.php, /PaddleNumList.php, or /admin/system/church-info with parameters containing <script>, onerror=, onload=, or javascript: strings.
Unusual parameter names in query strings containing angle brackets, quotes, or HTML tag fragments.
Outbound HTTP requests from user browsers to unknown external domains immediately after visiting ChurchCRM pages.
Session tokens observed in URLs of external referrer logs.

Detection Strategies

Deploy a Web Application Firewall (WAF) with signatures for reflected XSS patterns targeting the affected PHP endpoints.
Enable full HTTP request logging on the ChurchCRM web tier and alert on encoded script fragments in parameter names or values.
Correlate authentication events with anomalous administrative actions performed shortly after users visit externally referred URLs.

Monitoring Recommendations

Monitor for unexpected changes to church configuration data on /admin/system/church-info, which may indicate exploitation against administrators.
Track browser Content Security Policy (CSP) violation reports to identify script injection attempts.
Review outbound proxy logs for connections to attacker-controlled domains sourced from ChurchCRM user sessions.

How to Mitigate CVE-2026-58411

Immediate Actions Required

Upgrade ChurchCRM to version 7.4.0 or later, which resolves the vulnerability.
Invalidate active user sessions after upgrade to force re-authentication.
Reset administrator credentials if exploitation is suspected against privileged accounts.
Audit recent configuration changes and user activity on the three affected endpoints.

Patch Information

The maintainers resolved the issue in ChurchCRM version 7.4.0. The fix introduces proper output encoding on user-controlled parameter names and values before they are rendered into JavaScript and HTML attribute contexts. See the ChurchCRM Security Advisory GHSA-p6j6-vrpg-4pp8 for release notes and commit references.

Workarounds

Place ChurchCRM behind a WAF configured to block requests containing script tags or JavaScript event handlers in parameter names and values.
Restrict access to the ChurchCRM administrative interface using network-level controls or VPN gating until the patch is applied.
Configure a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS execution.

bash

# Example nginx CSP header to reduce inline script execution risk
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;