CVE-2026-35576 is a stored XSS vulnerability (CWE-79) in ChurchCRM's Person Property Management subsystem affecting versions before 7.0.0. Despite previous patches for CVE-2023-38766, this issue allows authenticated users to inject arbitrary JavaScript into person properties. The malicious script executes when other users access the affected profile or printable view, leading to high-impact consequences such as session hijacking and account compromise. The vulnerability has a CVSS 3.1 score of 8.7, indicating high severity. The fix is included in ChurchCRM version 7.0.0.

Successful exploitation allows an authenticated user to inject persistent malicious JavaScript code that executes in the context of other users viewing the affected person profile or printable view. This can lead to session hijacking or full account compromise, impacting confidentiality and integrity of user accounts. Availability is not affected.

Upgrade ChurchCRM to version 7.0.0 or later, where this vulnerability is fixed. No official patch or temporary fix is indicated for earlier versions. Since this is not a cloud service, remediation depends on applying the vendor's fixed version. Patch status is not explicitly confirmed beyond the fix in 7.0.0, so verify with vendor advisories before deployment.