CVE-2026-52520

Emlog CMS up to version 2.6.14 is affected by a stored XSS in the article publishing module (/admin/article.php). An authenticated attacker can inject JavaScript into article content; when an administrator previews or reviews the article, the script runs in the admin’s browser session, enabling a...