What is the CVSS score of CVE-2026-35576?

CVE-2026-35576 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-35576?

Within 24 hours: Inventory all ChurchCRM deployments and document current versions. Within 7 days: Upgrade all ChurchCRM instances to version 7.0.0 or later; validate upgrade completion across all systems. Within 30 days: Conduct security audit of Person Property Management subsystem for existing malicious payloads; reset sessions for all users who accessed potentially compromised profiles during vulnerability window; implement input validation and output encoding controls for the Person Property subsystem as defense-in-depth measure.

Crm CVE-2026-35576

Q: Which versions of Crm are affected by CVE-2026-35576?

ChurchCRM versions prior to 7.0.0 contain a stored cross-site scripting vulnerability in the Person Property Management subsystem that allows authenticated users to inject malicious code affecting…. A patch is available.

EUVD-2026-19774 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

XSS Crm

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:04 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.0.0

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19774

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:11 nvd

HIGH 8.7

DescriptionGitHub Advisory

ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0.

AnalysisAI

Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScript through the Person Property Management subsystem, executing when other users view affected profiles. This vulnerability persists despite previous CVE-2023-38766 patches and enables session hijacking or account compromise through persistent payload execution. No public exploit identified at time of analysis, though CVSS score of 8.7 reflects high impact with cross-site scripting scope allowing privilege escalation beyond the attacker's session context.

Technical ContextAI

This is a persistent XSS vulnerability (CWE-79) affecting the ChurchCRM open-source church management platform (cpe:2.3:a:churchcrm:crm). The flaw resides in the Person Property Management subsystem, which allows dynamic assignment of custom properties to person records. Insufficient input validation and output encoding on user-supplied property values enables injection of arbitrary JavaScript that is stored in the database and rendered without sanitization when profiles are accessed. The vulnerability demonstrates a regression or incomplete fix from CVE-2023-38766, indicating the previous patch did not adequately address all XSS attack vectors within the property management functionality. The cross-site scripting scope (S:C in CVSS vector) indicates the injected code executes in victims' browser contexts with different privileges than the attacker.

RemediationAI

Upgrade to ChurchCRM version 7.0.0 or later, which contains comprehensive fixes for the Person Property Management XSS vulnerability via pull request #8016 (https://github.com/ChurchCRM/CRM/pull/8016). Organizations unable to immediately upgrade should implement defense-in-depth controls including restricting person property modification permissions to highly trusted administrators only, deploying Content Security Policy headers to mitigate JavaScript execution, and conducting audit reviews of existing person properties for suspicious content. Review access logs for accounts that recently modified person properties and consider rotating session tokens for users who may have viewed affected profiles. Complete vendor advisory and upgrade guidance available at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r36-fvxj-26qv.