PT-2026-30941 · Churchcrm · Churchcrm

Saadet-T · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35575

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, contains a Stored Cross-Site Scripting (Stored XSS) issue in the admin panel’s group-creation feature. A user with group-creation privileges can inject malicious JavaScript that executes when an administrator views the page. This can lead to the theft of the administrator’s session cookies and potential full administrative account takeover.

Recommendations Update to version 6.5.3 or later.

Fix

XSS

Weakness Enumeration

CWE-1004

CWE-79

Related Identifiers

CVE-2026-35575

Affected Products

Churchcrm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35575 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w · Note
• https://twitter.com/CVEnew/status/2041569959650980102 · Twitter Post