Description
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getk2.org | K2 extension for Joomla | 1.0-2.26 | — |
References
- https://www.getk2.org/ product