Vulnerability Details CVE-2026-48940
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 3.4
References