The vulnerability is a stored cross‑site scripting flaw in the article editor of EmLog. Tag names are rendered without HTML encoding, allowing an attacker to embed malicious JavaScript such as ');alert(document.domain);//. When the article editor is later viewed, the browser interprets the injected script. This can lead to unauthorized script execution, cookie theft, session hijack, defacement, or malware distribution. The weakness is a classic input validation issue covered by CWE‑79.

The flaw affects EmLog open‑source website building system, version 2.6.29 and earlier. Administrators deploying those versions via the article editing interface are directly exposed; any user with editing privileges can craft a malicious tag. All publicly accessible instances of the editor that expose such tags fall under risk.

The reported CVSS score is 6.9, indicating a moderate to high severity. No EPSS score is available, but the vulnerability is not listed in CISA's KEV catalog. The attack requires web application interaction; an attacker can create the malicious tag through the editor interface, achieving client‑side code execution in the context of whomever views the page. Because no official patch or workaround exists at the time of publication, the risk persists until a vendor fix is released or a mitigation is applied.