CVE-2026-40483 Details
Description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers into the comment field, which are stored in the database and execute in the browser of any user who subsequently opens the pledge record for editing, resulting in stored XSS. This issue has been fixed in version 7.2.0.
A stored cross-site scripting vulnerability has been identified in ChurchCRM versions prior to 7.2.0. The issue arises in the Pledge Editor, where donation comments are rendered into HTML input value attributes without proper escaping. This flaw allows an authenticated user with Finance permissions to inject HTML attribute-breaking characters and event handlers into the comment field. The injected scripts are executed in the browser of any user who later opens the pledge record for editing. The vulnerability has been patched in version 7.2.0.
Users can update to ChurchCRM version 7.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChurchCRM/CRM/commit/b3da72a2b35f9c600e340a9dfd35e7792ff4f899 | [email protected] | Source CodeVendor |
| https://github.com/ChurchCRM/CRM/pull/8609 | [email protected] | Issue TrackingVendor |
| https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wjmf-w8gj-rx7g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChurchCRM | <= 7.1.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |