CVE-2026-58411 is a high-severity Cross-Site Scripting (CWE-79) vulnerability in ChurchCRM CRM versions before 7.4.0. The vulnerability arises from insufficient output encoding of user-controlled request parameter names and values, which are reflected in JavaScript string and HTML attribute contexts without proper sanitization. This improper neutralization allows attackers to inject malicious scripts via affected endpoints including /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. The vulnerability can be exploited to perform actions such as session hijacking, account takeover, and unauthorized operations, especially when targeting administrative users. The vulnerability has been fixed in version 7.4.0.

Successful exploitation of this XSS vulnerability can result in theft of session tokens, account takeover, unauthorized actions performed on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing attacks, and privilege escalation when administrators are targeted. These impacts can compromise the confidentiality, integrity, and availability of the affected system and its data.

This vulnerability is resolved in ChurchCRM version 7.4.0. Users and administrators should upgrade to version 7.4.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory stating the fix in version 7.4.0.