QwikSec

Security Database

CVE

CWE

Training

CVE-2026-40483

Published: Apr 17, 2026

Modified: Apr 20, 2026

PUBLISHED

CVSS v3.1

5.4

MEDIUM

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers into the comment field, which are stored in the database and execute in the browser of any user who subsequently opens the pledge record for editing, resulting in stored XSS. This issue has been fixed in version 7.2.0.

Vendor	Product	Versions
ChurchCRM	CRM	affected `< 7.2.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wjmf-w8gj-rx7g

x_refsource_CONFIRM

https://github.com/ChurchCRM/CRM/pull/8609

x_refsource_MISC

https://github.com/ChurchCRM/CRM/commit/b3da72a2b35f9c600e340a9dfd35e7792ff4f899

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2026-40483 | MEDIUM (5.4) - Security Vulnerability | QwikSec