CVE-2026-35574HIGH 8.7EPSS p22.2%

CVE-2026-35574CVE-2026-35574

Description

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.

Scoring

CVSS 3.18.7 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS0.31% probability of exploitation · percentile 22.2% · 2026-06-19T12:03:05Z
Published2026-04-07
Last modified2026-04-16

Underlying weaknesses· 1

CWE-79

References

  1. https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c
  2. https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')cwe-790%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-35575
CVE
CVE-2026-35576
CVE
CVE-2026-39344
CVE
CVE-2026-39332
CVE
CVE-2026-39328
CVE
CVE-2026-39318
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.