Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-48942

Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getk2.org K2 extension for Joomla

Default version status: unaffected

  • 1.0-2.26affected

References