CVSS base score
What the vulnerability does
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.
Explanation of Vulnerability in Simple Terms
The K2 extension for Joomla contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft input that, when processed by K2, executes arbitrary JavaScript in the browsers of site visitors or administrators. The exact attack vector and required privileges are not fully documented in available metadata.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers, potentially stealing session tokens or redirecting users.
Potential impact on your site
Visitors and administrators could be compromised via malicious scripts; site reputation and user data at risk.
Conditions required to exploit
Ability to submit input to K2 (exact method unclear from available data); may require user interaction or specific privileges.
Key dates
External resources
Related vulnerabilities
