VYPR
← All advisories
High severity7.3NVD Advisory· Published Apr 7, 2026· Updated Apr 16, 2026

CVE-2026-35574

CVE-2026-35574

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Churchcrm/Churchcrm2 versions
    cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*range: <6.5.3
    • (no CPE)range: <6.5.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.