This vulnerability in Emlog Pro v2.5.4 is a cross-site scripting (CWE-79) flaw that enables attackers to execute arbitrary scripts or HTML by injecting malicious payloads into the article header through the /admin/article.php endpoint. The CVSS 3.1 score is 7.3 (high), with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity, with low impact on availability. No official patch or remediation information is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially compromising confidentiality and integrity of data accessible to the user. The vulnerability requires local access and user interaction, limiting remote exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /admin/article.php interface to trusted users only and avoid interacting with untrusted content in the article header field.