ChurchCRM CRM versions before 7.2.0 suffer from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the Pledge Editor fails to escape donation comment values using htmlspecialchars(), allowing an authenticated Finance user to inject HTML attribute-breaking characters and event handlers. These malicious inputs are stored in the database and executed in the context of any user who subsequently edits the pledge record. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) and was fixed in version 7.2.0.

Successful exploitation allows an authenticated user with Finance permissions to inject and store malicious scripts that execute in the browsers of other users who view or edit the affected pledge records. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed in the context of the victim user. There is no indication of availability impact or known exploits in the wild.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability has been fixed by properly escaping input in the Pledge Editor. Since this is not a cloud service, manual patching is required. Patch status is not explicitly stated beyond the fix in 7.2.0, so verify with the vendor advisory for the latest remediation guidance.