Joomla Vulnerability in K2 Allows Script Injection for Authors

CVE-2026-48940

What is CVE-2026-48940?

A vulnerability exists in K2 for Joomla where an authenticated user with item creation permissions can inject malicious scripts via the 'embedVideo' POST field. The K2 plugin stores this script without escaping, allowing any visitor to execute the script when viewing the affected article page. This flaw poses significant risks, including potential data theft or site compromise.

References