Medium · 6.1 CVE-2026-48942 EUVD-2026-39439GHSA-5hmf-7m33-2v23

Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26

Published Jun 25, 2026 · Updated Jun 28, 2026 · Assigned by Joomla

Description

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

Vendor	Product	Affected	Fixed
getk2.org	K2 extension for Joomla	1.0-2.26	—