What is the CVSS score of CVE-2026-35574?

CVE-2026-35574 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Churchcrm are affected by CVE-2026-35574?

ChurchCRM versions before 6.5.3 contain a stored XSS vulnerability in the Note Editor that allows authenticated users to inject malicious scripts, potentially enabling session hijacking and privilege…. A patch is available.

How to fix or mitigate CVE-2026-35574?

Within 24 hours: inventory all ChurchCRM deployments and confirm current version status. Within 7 days: apply vendor patch by upgrading all ChurchCRM instances to version 6.5.3 or later, and validate successful deployment. Within 30 days: conduct access review of user accounts with Note Editor permissions and implement input validation testing on any custom ChurchCRM modifications.

Churchcrm CVE-2026-35574

EUVD-2026-19772 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 security-advisories@github.com

XSS Privilege Escalation Authentication Bypass Churchcrm

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 17:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5.3

EUVD ID Assigned

Apr 07, 2026 - 17:22 euvd

EUVD-2026-19772

Analysis Generated

Apr 07, 2026 - 17:22 vuln.today

CVE Published

Apr 07, 2026 - 17:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

AnalysisAI

Stored XSS in ChurchCRM Note Editor enables authenticated users to execute arbitrary JavaScript in victims' browsers, leading to session hijacking and privilege escalation against administrators managing sensitive church member data. Affects ChurchCRM versions prior to 6.5.3. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. EPSS and KEV data not provided; no public exploit identified at time of analysis. Vendor patch released in version 6.5.3.

Technical ContextAI

ChurchCRM is an open-source PHP-based church management system designed for managing membership, donations, and administrative tasks. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored cross-site scripting flaw in the Note Editor component. The application fails to properly sanitize or encode user-supplied input when rendering notes, allowing malicious JavaScript payloads to persist in the database and execute when other users view the compromised note. The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates network-accessible exploitation with low complexity, requiring low-privileged authenticated access (any user with note-adding permissions) and victim interaction (admin must view the malicious note). The stored nature makes this particularly dangerous as the payload persists and can affect multiple users over time, unlike reflected XSS which requires per-victim social engineering.

RemediationAI

Upgrade ChurchCRM to version 6.5.3 or later, which contains vendor-released fixes for the stored XSS vulnerability in the Note Editor. Organizations should update immediately by downloading the patched release from the official ChurchCRM GitHub repository. During the upgrade window, implement temporary mitigations including restricting note-adding permissions to only highly trusted administrative users, conducting audit reviews of existing notes for suspicious JavaScript content, and implementing Content Security Policy headers to limit script execution if technically feasible. After upgrading, review user activity logs for any suspicious note modifications that may have occurred prior to patching, as stored XSS payloads could have been injected before the fix was applied. Complete vendor advisory and patch details are available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c. Organizations unable to upgrade immediately should consider temporarily disabling the Note Editor feature if operationally feasible until patching can be completed.