CVE-2026-35574

Published: Apr 7, 2026Modified: Apr 16, 2026

8.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Exploitability: 2.3 / Impact: 5.8

Source: NVD

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

Affected (1)

Products: Churchcrm: Churchcrm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Churchcrm Churchcrm	Before 6.5.3

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.