Emlog is an open source website building system. The vulnerability exists in versions 2.6.13 and earlier. In those releases the admin backend user search module processes the keyword parameter from admin/user.php with addslashes but does not HTML‑escape it before rendering into the value attribute in admin/views/user.php. This flaw allows a reflected cross‑site scripting attack in an administrator’s backend session, enabling an attacker to inject malicious script that executes in the browser of an admin who views the affected page. The weakness is a classic input validation failure classified as CWE‑79. No fixed version is currently identified, leaving all users of affected releases vulnerable.

The vulnerability exists in emlog versions 2.6.13 and earlier. No fixed version is currently identified; users of those releases remain affected.

The CVSS score of 8.5 indicates a high severity reflected XSS vulnerability. The EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker crafting a request that triggers the vulnerable admin user search module, causing malicious script execution when an administrator accesses the affected backend page.