CyberRota Analysis
This is a low severity vulnerability with a CVSS score of 3.4. See the original NVD description below for full technical details.
CVE
CVE-2026-48940
Severity
LOW
CVSS
3.4
EPSS
0.17%
Original NVD Description
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.
Related CVEs
Other vulnerabilities affecting the same vendor(s)