CVE-2026-35574

HIGH

ChurchCRM <6.5.3 Person Profile Notes - Stored Cross-Site Scripting

Title source: manual
STIX 2.1

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

References (1)

Core 1
Core References

Scores

CVSS v3 7.3
EPSS 0.0031
EPSS Percentile 22.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
churchcrm/churchcrm < 6.5.3
ChurchCRM/CRM < 6.5.3
Published Apr 07, 2026
Tracked Since Apr 07, 2026