Stored Cross-Site Scripting Vulnerability in Emlog Website Builder
CVE-2026-21431

2LOW

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
2 January 2026

What is CVE-2026-21431?

Emlog, an open source website building system, contains a stored cross-site scripting vulnerability in the Resource media library function when publishing articles. This flaw allows attackers to inject script code into web pages viewable by users, potentially leading to data theft or website defacement. As of now, no patches have been released to correct this security issue.

Affected Version(s)

emlog = 2.5.23

References

https://github.com/emlog/emlog/security/advisories/GHSA-9...
x_refsource_CONFIRM

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.