ChurchCRM, an open-source church management system, had a stored XSS vulnerability (CWE-79) in its Note Editor component affecting versions before 6.5.3. Authenticated users with note-adding permissions could inject malicious scripts that execute in the context of other users, potentially compromising sessions and escalating privileges. The vulnerability was assigned CVE-2026-35574 with a CVSS 3.1 score of 7.3 (high severity). The flaw is resolved in ChurchCRM version 6.5.3.

Exploitation allows authenticated users with note-adding permissions to execute arbitrary JavaScript in other users' browsers, including administrators. This can result in session hijacking, privilege escalation, and unauthorized access to sensitive church member data. There are no known exploits in the wild as of the published date.

Upgrade ChurchCRM to version 6.5.3 or later, where this vulnerability is fixed. Since this is not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor stating the issue is fixed in 6.5.3.