RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.

RockRMS versions 16.13 and before version 17.7.0 contains a Cross Site Scripting (XSS) vulnerability in the Social Media links functionality within user profiles. This vulnerability allows attackers to inject malicious scripts that execute when other users view the affected profile. The XSS can potentially lead to privilege escalation within the RockRMS system. The vulnerability affects multiple versions of the church management software and has been assigned CVE-2026-36748. Users should upgrade to version 17.7.0 or later to mitigate this security issue.