Stored cross‑site scripting (XSS) exists in the comment module of emlog due to a bypass in URI scheme validation. This flaw allows a malicious actor to embed JavaScript payloads in comments that are subsequently rendered in other users' browsers. The impact includes cookie theft, session hijacking, defacement of the site, or redirection to malicious sites, thereby compromising confidentiality, integrity, and availability of the affected web application. The weakness corresponds to CWE‑79, which denotes an unsafe handling of untrusted input in web contexts.

emlog version 2.6.8 or higher addresses the issue. All installations using emlog prior to 2.6.8, including the "pro" edition, are affected. The vulnerability was identified in the open‑source website building system known as emlog, and the affected CPE suggests the product is under the namespace cpe:2.3:a:emlog:emlog:. Users should verify their installed version against the upstream release notes.

With a CVSS score of 6.1, the flaw poses a moderate threat level. The EPSS score below 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would typically involve submitting a comment containing malicious JavaScript, either through authenticated user input or through an unauthenticated commenting interface if the site does not enforce proper access controls. Attackers would then rely on victim browsers to execute the script, giving them the surface described above.