CVE-2026-52520 is a stored XSS vulnerability in Emlog CMS <= 2.6.14 within the /admin/article.php module. An attacker with authentication privileges can inject arbitrary JavaScript code into article content. When an administrator views the article in the backend, the script executes in the admin's browser session, potentially enabling the attacker to escalate privileges by performing administrative actions like creating a backdoor admin account. No official patch or remediation level has been published yet.

The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's session. This can lead to privilege escalation by enabling the attacker to perform administrative actions, including creating unauthorized administrator accounts. The impact includes partial confidentiality and integrity loss but no availability impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict article publishing permissions to trusted users only and monitor for suspicious activity related to article content submissions. Avoid previewing or reviewing articles from untrusted or unknown authors in the backend.