Platform
php
Component
emlog
Fixed in
2.5.18
CVE-2025-53924 describes a Cross-Site Scripting (XSS) vulnerability affecting Emlog Pro, an open-source website building system. This vulnerability allows authenticated attackers to inject arbitrary web scripts or HTML, potentially leading to account compromise and website defacement. The vulnerability impacts versions of Emlog Pro up to and including 2.5.17. A patched version, 2.5.18, is now available.
The XSS vulnerability in Emlog Pro allows an attacker to inject malicious JavaScript code into the siteurl parameter. Because this is a stored XSS, the injected script persists on the server. When a user clicks on a link containing the malicious script, the code executes in their browser within the context of the Emlog Pro website. This can lead to several consequences, including session hijacking, redirection to phishing sites, and the theft of sensitive user data like login credentials or personal information. An attacker could also modify the website's content, defacing the site or spreading malware to visitors. The blast radius extends to all users who interact with the affected website, particularly those who are logged in.
CVE-2025-53924 was published on 2025-07-16. As of the publication date, no known public exploits or proof-of-concept code are available. The EPSS score is pending evaluation. While no active campaigns targeting this specific vulnerability have been reported, the ease of exploitation associated with XSS vulnerabilities suggests a potential for future exploitation. Monitor security advisories and threat intelligence feeds for updates.
Exploit Status
EPSS
0.05% (15% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-53924 is to upgrade Emlog Pro to version 2.5.18 or later, which contains the fix. If upgrading immediately is not possible, consider implementing temporary workarounds. Input validation on the siteurl parameter is crucial; sanitize and escape any user-supplied input before rendering it in the HTML output. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Emlog Pro installations for suspicious activity, such as unusual JavaScript execution or unexpected redirects. After upgrading to 2.5.18, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the siteurl parameter and verifying that it is properly sanitized.
Actualice Emlog a una versión posterior a pro-2.5.17, si existe una disponible. De lo contrario, revise y filtre cuidadosamente las entradas del parámetro siteurl para evitar la inyección de código malicioso. Considere implementar validación y sanitización de entradas para mitigar el riesgo de XSS.
Vulnerability analysis and critical alerts directly to your inbox.
It's a Cross-Site Scripting (XSS) vulnerability in Emlog Pro website builder versions up to 2.5.17, allowing attackers to inject malicious code.
If you are using Emlog Pro version 2.5.17 or earlier, you are potentially affected by this vulnerability.
Upgrade Emlog Pro to version 2.5.18 or later to resolve the XSS vulnerability. Implement input validation as a temporary workaround.
No active campaigns targeting this specific vulnerability have been reported, but the potential for exploitation exists.
Refer to the Emlog security advisories and the National Vulnerability Database (NVD) entry for CVE-2025-53924 for more details.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.