Stored XSS Vulnerability in ChurchCRM Management System

CVE-2026-40593

What is CVE-2026-40593?

The ChurchCRM management system is susceptible to a stored XSS vulnerability due to improper handling of HTML characters in usernames. This issue arises in versions prior to 7.2.0, where the User Editor (UserEditor.php) directly renders stored usernames into HTML input value attributes without utilizing htmlspecialchars(). As a result, an attacker can save a username that contains malicious HTML characters or event handlers, which will execute in the browser of any administrator who accesses that user's editor page. This vulnerability poses significant risks as it enables the potential execution of arbitrary scripts, thus compromising the security of administrative users.

References