CVE-2025-61597: Emlog Pro is vulnerable to stored XSS attack through HTML template injection
Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61597?
CVE-2025-61597 is categorized as a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-61597?
To fix CVE-2025-61597, upgrade to Emlog version 2.5.22 or later, which addresses the HTML template injection vulnerability.
What impact does CVE-2025-61597 have on my Emlog site?
CVE-2025-61597 allows attackers to execute malicious scripts by injecting them into the mail template settings, potentially compromising your site's security.
Who is affected by CVE-2025-61597?
CVE-2025-61597 affects all Emlog installations running version 2.5.21 or below.
Is there a workaround for CVE-2025-61597 if I cannot upgrade immediately?
Currently, there is no known workaround for CVE-2025-61597; upgrading to a patched version is strongly recommended.