CVE-2026-34229 MEDIUM

CVE-2026-34229: Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass

Vendor Emlog

Product emlog

Weakness CWE-79 · XSS

Published April 3, 2026

Last update April 6, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.

Key dates

02Disclosure timeline

April 3, 2026 CVE published

April 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-34229 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-8722 Content Views <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets CVE-2024-31928 WordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2023-2076 Campcodes Online Traffic Offense Management System Users.phpp cross site scripting CVE-2026-9377 SourceCodester SUP Online Shopping productedit.php cross site scripting CVE-2024-26031 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)