What is the CVSS score of CVE-2026-35575?

CVE-2026-35575 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Crm are affected by CVE-2026-35575?

ChurchCRM versions prior to 6.5.3 contain a stored cross-site scripting vulnerability in the admin panel that allows authenticated users with group-creation privileges to execute malicious code and…. A patch is available.

How to fix or mitigate CVE-2026-35575?

Within 24 hours: Identify all ChurchCRM installations and document current versions. Within 7 days: Upgrade all instances to ChurchCRM 6.5.3 or later; restrict group-creation privileges to trusted administrators only pending upgrade. Within 30 days: Audit group creation logs for suspicious entries created by non-administrative users; force re-authentication of all administrator accounts to invalidate potentially compromised sessions.

Crm CVE-2026-35575

EUVD-2026-19773 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

XSS Crm

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5.3

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19773

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:08 nvd

HIGH 8.0

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This enables attackers to steal the administrator’s session cookies, potentially leading to full administrative account takeover. This vulnerability is fixed in 6.5.3.

AnalysisAI

Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover through malicious group names. Authenticated users with group-creation privileges can inject JavaScript that executes when administrators view group listings, stealing session cookies. ChurchCRM versions prior to 6.5.3 are affected. No public exploit identified at time of analysis, with EPSS data unavailable, though the low attack complexity (AC:L) and availability of technical details in the GitHub Security Advisory increase exploitation risk for authenticated internal threats.

Technical ContextAI

ChurchCRM is an open-source church management system built on PHP and MySQL, commonly used by religious organizations for member tracking, attendance, donations, and group management. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the group-creation functionality within the administrative panel. The application fails to properly sanitize user-supplied input when creating group names or related metadata, allowing HTML and JavaScript injection. When administrators navigate to pages displaying group listings, the stored malicious script executes in their browser context with full administrative privileges. The affected product is identified as cpe:2.3:a:churchcrm:crm:*:*:*:*:*:*:*:*, indicating the core ChurchCRM application across all deployment environments. The CVSS vector AV:N indicates network-accessible exploitation, though PR:L confirms that the attacker must possess valid credentials with group-creation permissions, making this an insider threat or compromised low-privilege account scenario rather than an anonymous external attack.

RemediationAI

Upgrade ChurchCRM to version 6.5.3 or later, which contains input sanitization fixes for the group-creation feature that prevent stored XSS injection. The vendor-released patch addresses CWE-79 by implementing proper output encoding and input validation for group-related fields within the administrative interface. Organizations should download version 6.5.3 from the official ChurchCRM GitHub repository and follow standard upgrade procedures including database backup, dependency updates, and post-upgrade testing of group management functionality. The complete security advisory with technical details and upgrade guidance is published at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w. As an interim risk-reduction measure prior to patching, organizations may restrict group-creation privileges to only highly-trusted administrators, implement enhanced monitoring of group creation activities, and conduct periodic reviews of existing group names for suspicious JavaScript patterns. However, these workarounds do not eliminate the vulnerability and should not replace timely patching. Organizations should also review administrator session logs for evidence of unauthorized access following any suspicious group creation events, and consider forced session invalidation and password resets for administrative accounts if compromise is suspected.