A Joomla user possessing K2 “create item” rights can submit an article whose embedVideo POST field contains a raw <script> tag. K2 stores that tag unchanged and renders it unescaped on the article page, causing any visitor’s browser to execute the contained script. This stored cross‑site scripting flaw enables an attacker to run arbitrary JavaScript in the browsers of all page visitors, leading to potential defacement, credential theft, or session hijacking.

The vulnerability affects the K2 extension for Joomla hosted by getk2.com, specifically versions older than 2.26. No explicit version list is available, but any site running that extension before the patch is at risk. Joomla installations are commonly used by small to medium‑sized websites, so the reach of the flaw is broad.

The EPSS score is not provided and the flaw is not listed in CISA KEV, but the lack of input sanitization allows straightforward exploitation. An attacker only needs author‑level access to the Joomla backend to inject the malicious script, which is then executed automatically for every visitor. Because the attack occurs entirely via the web interface and no network‑level prerequisites exist, the risk is high for exposed sites.