CVE-2026-40483

MEDIUM

5.4

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers into the comment field, which are stored in the database and execute in the browser of any user who subsequently opens the pledge record for editing, resulting in stored XSS. This issue has been fixed in version 7.2.0.

CVE Details

CVSS v3.1 Score5.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published4/18/2026

Last Modified4/20/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79CWE-116

References

https://github.com/ChurchCRM/CRM/commit/b3da72a2b35f9c600e340a9dfd35e7792ff4f899(security-advisories@github.com)

https://github.com/ChurchCRM/CRM/pull/8609(security-advisories@github.com)

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wjmf-w8gj-rx7g(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.