CVE-2026-35574CWE-79

ChurchCRM has a Stored XSS in Person Profile - Add a Note

High · published April 7, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-07T17:04Z
EPSS history
Timeline
  • 07 APR 17:04Z
    ChurchCRM has a Stored XSS in Person Profile - Add a Note
    cvelistv5