CVE-2026-46686: Emlog Reflected Cross-Site Scripting

Q: What is the severity of CVE-2026-46686?

CVE-2026-46686 has a risk score of 40, indicating a significant security vulnerability.

Q: How do I fix CVE-2026-46686?

To fix CVE-2026-46686, upgrade to Emlog version 2.6.14 or later where the vulnerability has been addressed.

Q: What type of vulnerability is CVE-2026-46686?

CVE-2026-46686 is classified as a reflected cross-site scripting (XSS) vulnerability.

Q: Which versions of Emlog are affected by CVE-2026-46686?

CVE-2026-46686 affects Emlog versions 2.6.13 and earlier.

Q: What component of Emlog is impacted by CVE-2026-46686?

CVE-2026-46686 impacts the admin backend user search module in the Emlog web application.

Published Jul 16, 2026

Updated

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.

Affected Software

1 affected component

Emlog emlog<=2.6.13

Event History

Jul 16, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-46686?

CVE-2026-46686 has a risk score of 40, indicating a significant security vulnerability.

How do I fix CVE-2026-46686?

To fix CVE-2026-46686, upgrade to Emlog version 2.6.14 or later where the vulnerability has been addressed.

What type of vulnerability is CVE-2026-46686?

CVE-2026-46686 is classified as a reflected cross-site scripting (XSS) vulnerability.

Which versions of Emlog are affected by CVE-2026-46686?

CVE-2026-46686 affects Emlog versions 2.6.13 and earlier.

What component of Emlog is impacted by CVE-2026-46686?