ChurchCRM’s User Editor (UserEditor.php) concatenates stored usernames directly into an HTML input value attribute. Because the application forgets to escape special characters, an administrator can save a username that contains attribute‑breaking characters and JavaScript event handlers. When any other administrator loads that user’s editor page, the malicious script runs in their browser, allowing the attacker to execute arbitrary code in the context of the admin user, steal credentials or deface content. The flaw is a classic stored cross‑site scripting vulnerability (CWE‑79).

All installations of the ChurchCRM open‑source church management system that use versions older than 7.2.0 are affected. The vulnerability resides in the UserEditor.php component of the core web application. Updating to the fixed version 7.2.0 removes the flaw.

The CVSS score of 4.8 indicates moderate severity, and no EPSS score is available, suggesting that exploitation is not frequently observed. The issue is not listed in CISA’s KEV catalog. Attackers must first gain administrative access or compromise an administrator account to inject a malicious username, making the attack vector privileged or authenticated. If achieved, the script executes in any administrator who subsequently views the malformed user entry, potentially giving the attacker the same privileges as that administrator.