CVE-2026-58411 Details

A reflected cross-site scripting vulnerability has been identified in ChurchCRM, an open-source church management system, prior to version 7.4.0. This vulnerability arises from inadequate output encoding of user-controlled request parameter names and values, allowing attackers to inject malicious scripts that are executed in the context of the user's browser. Affected endpoints include '/FamilyCustomFieldsEditor.php', '/PaddleNumList.php', and '/admin/system/church-info'. The exploitation of this vulnerability could lead to session token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing attacks, and privilege escalation when targeting administrators.

Users are advised to update to ChurchCRM version 7.4.0 or later. Additionally, context-sensitive output encoding should be applied to all user-controlled data before it is rendered in JavaScript string contexts, HTML attribute contexts, and HTML body contexts. It is also recommended to enforce allowlists for accepted parameter names, reject unexpected request parameters, avoid embedding request parameters directly into JavaScript, use framework-provided escaping functions consistently, and add automated XSS regression tests.