Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35574ChurchCRM has a Stored XSS in Person Profile - Add a Note

High 7.3

In plain English

A high-severity cross-site scripting in CRM from ChurchCRM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

Affected products (as reported)

Vendor	Product	Versions
ChurchCRM	CRM	< 6.5.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c x_refsource_CONFIRM