Stored Cross-Site Scripting in Emlog Website Builder by Emlog
CVE-2026-21432

6.8MEDIUM

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
2 January 2026

What is CVE-2026-21432?

Emlog, an open-source website building system, contains a stored cross-site scripting vulnerability in version 2.5.23. This vulnerability can be exploited to perform arbitrary actions on behalf of users, potentially leading to account takeover, including administrative accounts. As of now, there are no patched versions available, making it crucial for users to remain vigilant and implement appropriate security measures.

Affected Version(s)

emlog = 2.5.23

References

https://github.com/emlog/emlog/security/advisories/GHSA-4...
x_refsource_CONFIRM

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.