CVE-2026-35574 Details

A stored Cross-Site Scripting (XSS) vulnerability has been identified in ChurchCRM, an open-source church management system, prior to version 6.5.3. This vulnerability allows authenticated users with permission to add notes to execute arbitrary JavaScript in the context of other users' browsers, including administrators. The issue arises because the Note Editor does not properly sanitize user input before storing it, enabling the execution of malicious scripts when the notes are viewed. The vulnerability could lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data.

Users should update to ChurchCRM version 6.5.3 or later, where this vulnerability has been fixed.