Stored XSS Vulnerability in ChurchCRM Affects Versions Prior to 7.2.0

CVE-2026-40483

What is CVE-2026-40483?

In ChurchCRM, an open-source church management system, versions prior to 7.2.0 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The issue arises when the Pledge Editor directly renders donation comment values into HTML input value attributes without proper escaping. This flaw allows authenticated users with Finance permissions to inject malicious HTML attributes and event handlers into the comment field. These injected scripts are then stored in the database and executed in the browsers of users who access the pledge record for editing. The vulnerability poses significant risks to user data integrity and security.

References