The vulnerability in Emlog 2.6.29 and earlier allows a malicious user to embed raw HTML, including <script> tags, into Markdown content. Because the Parsedown parser is invoked without safe mode, this HTML is not escaped or filtered and is stored directly in the database. When the article is rendered, the browser interprets the <script> tags as executable JavaScript, providing an attacker with the ability to run arbitrary client‐side code in the context of the site, potentially leading to credential theft, session hijacking, defacement, or other malicious actions.

The affected product is the open‑source Emlog content management system from the vendor emlog. All deployments running version 2.6.29 or older are susceptible; no other version ranges or fixes are documented in the advisory. The advisory does not indicate that newer releases contain a fix, so any installation at or below the stated version should be treated as vulnerable.

The CVSS score of 8.7 indicates a high‐severity risk, reflecting that the flaw can compromise the confidentiality, integrity, and availability of all site visitors. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can achieve exploitation by creating or modifying an article with malicious Markdown; no special credentials beyond article posting rights are required. Because the payload is stored, every visitor who loads the affected article is exposed to the XSS attack.