Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
ChurchCRM usernames can trigger malicious browser behavior
CVE-2026-40593
Summary
In ChurchCRM versions before 7.2.0, malicious usernames can cause unintended actions when viewed by an administrator. This could lead to unauthorized access or data theft. Update to version 7.2.0 or later to fix this issue.
Original title
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without apply...
Original description
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user's editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0.
nvd CVSS3.1
4.8
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
CWE-116
Published: 18 Apr 2026 · Updated: 18 Apr 2026 · First seen: 18 Apr 2026