Cross-Site Scripting Vulnerability in Emlog Website Builder
CVE-2026-73848

6.9MEDIUM

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
4 September 2026

What is CVE-2026-73848?

Emlog, an open-source website building platform, has a vulnerability that allows for cross-site scripting (XSS) in its article editor. In versions 2.6.29 and earlier, the system fails to properly HTML-encode tag names, enabling attackers to inject malicious JavaScript code. This occurs because the 'addslashes()' function does not escape HTML entities effectively, allowing the injection of scripts that may execute arbitrary code in the context of unsuspecting users. As of now, no public patches are available to mitigate this security issue, highlighting the need for users to stay vigilant and take preventive measures.

Affected Version(s)

emlog <= 2.6.29

References

https://github.com/emlog/emlog/security/advisories/GHSA-f...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.