PT-2026-30887 · Churchcrm · Churchcrm

Curly-Haired-Baboon · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35534

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description ChurchCRM is an open-source church management system. A stored cross-site scripting issue exists in the PersonView.php file because of the incorrect use of sanitizeText() as an output sanitizer for an HTML attribute context. The function only removes HTML tags and does not escape quote characters, allowing an attacker to break out of the href attribute and inject arbitrary JavaScript event handlers. Any authenticated user with the EditRecords role can store the payload in a person's Facebook field. The XSS is triggered against any user who views that person's profile page, including administrators, potentially enabling session hijacking and full account takeover.

Recommendations Update to version 7.1.0 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-87

CWE-116

CWE-79

Related Identifiers

CVE-2026-35534

Affected Products

Churchcrm

References · 4

• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqp6-54p2-m66f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35534 · Security Note
• https://twitter.com/VulmonFeeds/status/2041588848816181407 · Twitter Post
• https://twitter.com/CVEnew/status/2041603200633950335 · Twitter Post