CVE-2026-48940
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Jun 25, 2026
Vendor
unknown
Description
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.