CVE-2026-40593

OVERVIEW ChurchCRM, an open-source church management system, contains a stored cross-site scripting (XSS) vulnerability in the User Editor component (UserEditor.php) affecting versions prior to 7.2.0. The vulnerability results from improper output encoding where usernames are rendered directly into HTML input value attributes without sanitization, allowing malicious code injection through specially crafted username values. SEVERITY The vulnerability carries a CVSS score of 4.8 (Medium) with a network-based attack vector requiring high-level administrative privileges and user interaction. While the attack surface is limited to administrator accounts viewing the user editor, successful exploitation results in stored XSS capable of compromising administrator sessions and potentially enabling unauthorized administrative actions. The impact is limited to confidentiality and integrity, with no availability impact. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with an EPSS score of 0.00009 indicating minimal real-world exploitation probability. The vulnerability is not tracked on the Known Exploited Vulnerabilities catalog and remains inactive on security hot lists. The issue has been remediated in version 7.2.0, and organizations should prioritize upgrading to mitigate this privilege-escalation vector targeting administrative users.