Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers inject arbitrary web script or HTML via the siteurl parameter. It possible malicious code into parameter resulting Stored XSS. When someone clicks on link executed. As of time publication, no known patched versions exist.