Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35576ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php

High 8.7

In plain English

A high-severity cross-site scripting in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 7.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv x_refsource_CONFIRM
https://github.com/ChurchCRM/CRM/pull/8016 x_refsource_MISC