---
title: "ChurchCRM CRM vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/churchcrm/crm
type: product
description: "ChurchCRM CRM has 127 published CVEs, 0 in CISA KEV and 115 with public exploits."
updated: 2026-07-13
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# ChurchCRM CRM vulnerabilities

Vendor: [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm)

- **Published CVEs:** 127
- **In CISA KEV:** 0
- **With a public exploit:** 115
- **With a patch:** 75
- **Average CVSS:** 7.5
- **First CVE:** 2022-05-15
- **Latest CVE:** 2026-07-13

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 25 |
| High | 62 |
| Medium | 38 |
| Low | 2 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 51 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 37 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 5 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 3 |
| [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 3 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 3 |
| [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 2 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2022 | 4 |
| 2023 | 33 |
| 2024 | 11 |
| 2025 | 29 |
| 2026 | 50 |

## Affected versions (top 24 of 218)

| Version | Kind | CVEs |
| --- | --- | --- |
| 2.0.0 | exact | 123 |
| 2.0.1 | exact | 123 |
| 2.1.0 | exact | 123 |
| 2.1.1 | exact | 123 |
| 2.1.10 | exact | 123 |
| 2.1.11 | exact | 123 |
| 2.1.2 | exact | 123 |
| 2.1.3 | exact | 123 |
| 2.1.4 | exact | 123 |
| 2.1.5 | exact | 123 |
| 2.1.6 | exact | 123 |
| 2.1.7 | exact | 123 |
| \< 7.1.0 | range | 23 |
| \< 6.5.3 | range | 15 |
| \< 7.2.0 | range | 8 |
| \< 7.4.0 | range | 4 |
| \< 7.3.2 | range | 3 |
| \< 6.5.0 | range | 2 |
| \< 6.7.2 | range | 2 |
| \< 7.0.0 | range | 2 |
| \< 5.21.0 | range | 1 |
| \< 5.9.2 | range | 1 |
| \< 6.0.0 | range | 1 |
| \< 6.5.4 | range | 1 |

## CVEs (first 30 of 127, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | high | 7.0 | No | Yes | Yes |
| CVE-2026-58410 | ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records | high | 7.1 | No | Yes | Yes |
| CVE-2026-58409 | ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload | critical | 9.1 | No | Yes | Yes |
| CVE-2026-58408 | ChurchCRM : Broken Access Control in \`CSVCreateFile.php\` Allows Low-Privileged Users to Export All Members' PII | medium | 6.5 | No | No | Yes |
| CVE-2026-44548 | ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) | high | 8.1 | No | Yes | No |
| CVE-2026-44547 | ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 | critical | 9.6 | No | Yes | Yes |
| CVE-2026-42288 | ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB\_PASSWORD | critical | 10.0 | No | Yes | No |
| CVE-2026-42289 | ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation | high | 8.8 | No | Yes | No |
| CVE-2026-40593 | ChurchCRM: Stored XSS in UserEditor.php via Login Name Field | medium | 4.8 | No | No | Yes |
| CVE-2026-40581 | ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion | high | 8.1 | No | Yes | Yes |
| CVE-2026-40485 | ChurchCRM: Username Enumeration via Differential Response in Public Login API | medium | 5.3 | No | Yes | Yes |
| CVE-2026-40484 | ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function | critical | 9.1 | No | Yes | Yes |
| CVE-2026-40483 | ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field | medium | 5.4 | No | Yes | Yes |
| CVE-2026-40582 | ChurchCRM: Authentication Bypass in \`/api/public/user/login\` Allows Bypass of 2FA and Account Lockout | critical | 9.1 | No | Yes | Yes |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in \`/api/person/{personId}\` | high | 7.1 | No | Yes | Yes |
| CVE-2026-40482 | ChurchCRM has Authenticated SQL Injection in \`/api/families/byCheckNumber/{scanString}\` | high | 7.1 | No | No | Yes |
| CVE-2026-39940 | ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php | medium | 5.3 | No | No | Yes |
| CVE-2026-39941 | ChurchCRM has an XSS vulnerability | medium | 5.3 | No | Yes | Yes |
| CVE-2026-39337 | ChurchCRM Affected by Unauthenticated RCE in Install Wizard | critical | 10.0 | No | Yes | Yes |
| CVE-2026-39319 | ChurchCRM has a Second Order SQLI via FundRaiserEditor.php | high | 8.8 | No | Yes | Yes |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | high | 8.1 | No | Yes | Yes |
| CVE-2026-39343 | ChurchCRM has a SQL Injection in Event Type Editor (Admin) | high | 7.2 | No | Yes | Yes |
| CVE-2026-39342 | ChurchCRM has a SQL injection searchwhat parameter via QueryView.php | critical | 9.4 | No | Yes | Yes |
| CVE-2026-39341 | SQL injection in ChurchCRM.0 | high | 8.1 | No | Yes | Yes |
| CVE-2026-39340 | ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution | high | 8.1 | No | Yes | Yes |
| CVE-2026-39339 | ChurchCRM has an API Authentication Bypass | critical | 9.1 | No | Yes | Yes |
| CVE-2026-39338 | ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration | high | 8.6 | No | Yes | Yes |
| CVE-2026-39336 | ChurchCRM has Stored XSS from unescaped config values in HTML attributes | medium | 6.1 | No | Yes | Yes |
| CVE-2026-39334 | ChurchCRM has a Blind SQL injection in SettingsIndividual.php | high | 8.8 | No | Yes | Yes |
| CVE-2026-39333 | ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php | high | 8.7 | No | No | Yes |

## Frequently asked questions

### How many CVEs does ChurchCRM CRM have?

ChurchCRM CRM has 127 published CVE records since 2022.

### How many ChurchCRM CRM CVEs are in CISA KEV?

None of ChurchCRM CRM's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for ChurchCRM CRM vulnerabilities?

Yes — 115 of ChurchCRM CRM's CVEs have a known public exploit.

### Which versions of ChurchCRM CRM are affected?

218 distinct ChurchCRM CRM versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in ChurchCRM CRM CVEs?

ChurchCRM CRM's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-94 (Improper Control of Generation of Code ('Code Injection')).

### How many critical ChurchCRM CRM vulnerabilities are there?

ChurchCRM CRM has 25 critical and 62 high-severity CVEs.

### What is the average severity of ChurchCRM CRM CVEs?

The average CVSS base score across ChurchCRM CRM's scored CVEs is 7.5.

## Other products from this vendor

- [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm/churchcrm) (110 CVEs)
- [ChurchCRM Backup Restore Handler](https://radicalnotion.ai/vendor/churchcrm/churchcrm-backup-restore-handler) (1 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/churchcrm/crm). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.