CVE-2026-40593 is a stored cross-site scripting vulnerability in ChurchCRM's UserEditor.php prior to version 7.2.0. The vulnerability occurs because usernames are output into an HTML input value attribute without applying htmlspecialchars() or equivalent encoding, enabling injection of HTML attribute-breaking characters and event handlers. An administrator can exploit this by saving a crafted username that triggers script execution in the browsers of other administrators viewing the user editor page. The vulnerability has been addressed in ChurchCRM version 7.2.0.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary scripts in the browsers of other administrators who view the compromised user's editor page. This can lead to theft of session tokens, manipulation of the web interface, or other actions permitted by the victim administrator's privileges. The CVSS 3.1 base score is 4.8 (medium severity), reflecting limited impact due to the requirement for administrator privileges and user interaction.

Upgrade ChurchCRM to version 7.2.0 or later, where this vulnerability has been fixed by properly encoding usernames before rendering them in HTML. Since no official patch link or vendor advisory is provided, verify the upgrade from the official ChurchCRM release notes or repository. Until upgraded, restrict administrator access and avoid viewing user editor pages with untrusted usernames.