Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M

CVE-2026-73848Emlog: Stored XSS via Tag Name in Article Editor

Medium 6.9

In plain English

A medium-severity cross-site scripting in emlog from emlog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 61.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= 2.6.29

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-fv6h-wr92-v4pj x_refsource_CONFIRM