Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jun 28, 2026
Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26
CVE-2026-48942
Description
K2 ≤ 2.26 renders the #__k2_users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping.
Patches
Vulnerability mechanics
References
1- www.getk2.orgmitreproduct
News mentions
0No linked articles in our index yet.