CVE-2026-35576 is a stored cross-site scripting (XSS) vulnerability in ChurchCRM's Person Property Management subsystem affecting versions prior to 7.0.0. An authenticated user can inject arbitrary JavaScript code through dynamically assigned person properties, which is then persistently stored and executed in the context of other users viewing the affected profiles or printable views. This vulnerability allows for potential session hijacking or full account compromise. The vulnerability persists despite patches for CVE-2023-38766 and is resolved in ChurchCRM version 7.0.0.

Successful exploitation allows an authenticated user to inject malicious JavaScript that executes in other users' browsers when they view affected person profiles or printable views. This can lead to session hijacking or full account compromise. The vulnerability does not affect availability but has high confidentiality and integrity impact. There are no known exploits in the wild as of the published date.

Upgrade ChurchCRM to version 7.0.0 or later, where this vulnerability is fixed. Since no official patch or temporary fix is documented beyond this version upgrade, applying the update is the recommended remediation. No additional vendor advisory content is available to suggest alternative mitigations or indicate that no action is required.