CVE-2026-35534
Stored XSS in ChurchCRM PersonView.php Enables Account Takeover
Publication date: 2026-04-07
Last updated on: 2026-04-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| churchcrm | churchcrm | to 7.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-87 | The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35534 is a stored cross-site scripting (XSS) vulnerability in ChurchCRM versions up to 7.0.5, specifically in the PersonView.php file. The issue arises because the function sanitizeText() is incorrectly used as an output sanitizer for an HTML attribute context. This function only strips HTML tags but does not escape quote characters, allowing an attacker to break out of the href attribute in a Facebook link and inject arbitrary JavaScript event handlers.
An authenticated user with the EditRecords role can inject malicious JavaScript payloads into a person's Facebook field. When any user views that person's profile page, including administrators, the injected script executes, enabling actions like session hijacking and full account takeover.
The root cause is improper sanitization and escaping of user input in HTML attribute context, allowing attribute breakout and script injection.
How can this vulnerability impact me? :
This vulnerability allows any authenticated user with the EditRecords role to inject malicious JavaScript into any person's Facebook field in the ChurchCRM system.
- Injected scripts execute when any user views the infected profile page, including administrators.
- Attackers can hijack user sessions, potentially taking over accounts.
- Sensitive data such as financial records and personally identifiable information can be exfiltrated.
- Attackers can perform unauthorized actions on behalf of victims, such as creating admin accounts or exporting data.
- The attack can persist across all users who view the compromised profile.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if any Facebook field in the ChurchCRM system contains malicious payloads that exploit improper sanitization, such as JavaScript event handlers injected via quote characters.
Since the vulnerability involves stored cross-site scripting in the Facebook field of person profiles, detection involves inspecting database entries or application data for suspicious input patterns like " onmouseover=" or other JavaScript event handlers embedded in the Facebook field.
Suggested commands include querying the database for Facebook field values containing suspicious characters or patterns. For example, if using SQL, a command might be:
- SELECT id, Facebook FROM persons WHERE Facebook LIKE '%" onmouseover=%' OR Facebook LIKE '%" onclick=%' OR Facebook LIKE '%" onerror=%';
Additionally, reviewing web server logs or using web application scanners to detect reflected or stored XSS payloads when viewing person profiles can help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ChurchCRM to version 7.1.0 or later, where this vulnerability is fixed.
If upgrading immediately is not possible, restrict or review the permissions of users with the EditRecords role to prevent unauthorized injection of malicious payloads.
Additionally, sanitize existing Facebook field entries in the database to remove any injected JavaScript event handlers or suspicious characters.
Implement proper output escaping in the application code by replacing the unsafe sanitizeText() function with attribute-safe escaping functions such as InputUtils::escapeAttribute() for HTML attributes and InputUtils::escapeHTML() for HTML content.
Monitor user activity and audit logs for suspicious edits to person profiles, especially Facebook fields.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to hijack sessions and exfiltrate sensitive data, including personally identifiable information (PII) and financial records, by injecting malicious JavaScript via a stored cross-site scripting (XSS) flaw.
Such unauthorized access and data exposure can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information against unauthorized access and breaches.
Because the vulnerability enables attackers to perform actions on behalf of victims and maintain persistent attacks, it increases the risk of data breaches and compromises the confidentiality and integrity of protected data, potentially resulting in regulatory penalties and loss of trust.