Vulnerability · Published Apr 18, 2026 · Assigned by GitHub_M

CVE-2026-40593ChurchCRM: Stored XSS in UserEditor.php via Login Name Field

Medium 4.8

In plain English

A medium-severity cross-site scripting in CRM from ChurchCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user's editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 7.2.0

Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7h46-9f64-p49q x_refsource_CONFIRM