Compliance Impact

The vulnerability allows attackers to hijack sessions and exfiltrate sensitive data, including personally identifiable information (PII) and financial records, by injecting malicious JavaScript via a stored cross-site scripting (XSS) flaw.

Such unauthorized access and data exposure can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information against unauthorized access and breaches.

Because the vulnerability enables attackers to perform actions on behalf of victims and maintain persistent attacks, it increases the risk of data breaches and compromises the confidentiality and integrity of protected data, potentially resulting in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35534 is a stored cross-site scripting (XSS) vulnerability in ChurchCRM versions up to 7.0.5, specifically in the PersonView.php file. The issue arises because the function sanitizeText() is incorrectly used as an output sanitizer for an HTML attribute context. This function only strips HTML tags but does not escape quote characters, allowing an attacker to break out of the href attribute in a Facebook link and inject arbitrary JavaScript event handlers.

An authenticated user with the EditRecords role can inject malicious JavaScript payloads into a person's Facebook field. When any user views that person's profile page, including administrators, the injected script executes, enabling actions like session hijacking and full account takeover.

The root cause is improper sanitization and escaping of user input in HTML attribute context, allowing attribute breakout and script injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated user with the EditRecords role to inject malicious JavaScript into any person's Facebook field in the ChurchCRM system.

• Injected scripts execute when any user views the infected profile page, including administrators.
• Attackers can hijack user sessions, potentially taking over accounts.
• Sensitive data such as financial records and personally identifiable information can be exfiltrated.
• Attackers can perform unauthorized actions on behalf of victims, such as creating admin accounts or exporting data.
• The attack can persist across all users who view the compromised profile.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if any Facebook field in the ChurchCRM system contains malicious payloads that exploit improper sanitization, such as JavaScript event handlers injected via quote characters.

Since the vulnerability involves stored cross-site scripting in the Facebook field of person profiles, detection involves inspecting database entries or application data for suspicious input patterns like " onmouseover=" or other JavaScript event handlers embedded in the Facebook field.

Suggested commands include querying the database for Facebook field values containing suspicious characters or patterns. For example, if using SQL, a command might be:

• SELECT id, Facebook FROM persons WHERE Facebook LIKE '%" onmouseover=%' OR Facebook LIKE '%" onclick=%' OR Facebook LIKE '%" onerror=%';

Additionally, reviewing web server logs or using web application scanners to detect reflected or stored XSS payloads when viewing person profiles can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, restrict or review the permissions of users with the EditRecords role to prevent unauthorized injection of malicious payloads.

Additionally, sanitize existing Facebook field entries in the database to remove any injected JavaScript event handlers or suspicious characters.

Implement proper output escaping in the application code by replacing the unsafe sanitizeText() function with attribute-safe escaping functions such as InputUtils::escapeAttribute() for HTML attributes and InputUtils::escapeHTML() for HTML content.

Monitor user activity and audit logs for suspicious edits to person profiles, especially Facebook fields.

Useful 0 Not Useful 0