CVE-2026-21432CWE-79

Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO

Medium · published January 2, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including takeover of admin accounts. As of time of publication, no known patched versions are available.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
EPSS
0.00197 · 8.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-02T18:58Z
EPSS history
Timeline
  • 02 JAN 18:58Z
    Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO
    cvelistv5