CVE-2026-39336 is a stored cross-site scripting vulnerability in ChurchCRM prior to version 7.1.0. It arises from improper neutralization of input during web page generation, specifically in Directory Reports form fields set from configuration, Person editor default address fields, and external self-registration form defaults. The vulnerability mainly involves an admin-to-admin attack vector where writable configuration fields are abused to inject malicious scripts. This vulnerability is addressed and fixed in ChurchCRM version 7.1.0.

Successful exploitation allows an authenticated admin user to execute arbitrary scripts in the context of other admin users, potentially leading to credential theft or unauthorized actions within the admin interface. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild at this time.

Upgrade ChurchCRM to version 7.1.0 or later, where this stored XSS vulnerability is fixed. Since this is not a cloud service, remediation depends on applying this official fix. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified or required beyond applying the update.