What is the CVSS score of CVE-2026-48940?

CVE-2026-48940 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

K2 for Joomla CVE-2026-48940

EUVD-2026-39445 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Joomla

GHSA-4gq9-7rp6-9749

XSS K2 Extension For Joomla Getk2 Com

3.4

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

3.4 LOW

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

vuln.today AI

5.4 MEDIUM

PR:L chosen over PR:H because Author-tier is a low-privilege CMS role; I:L added to reflect stored XSS enabling DOM manipulation in the victim's browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 21:41 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

3.4 (LOW)

CVE Published

Jun 25, 2026 - 15:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose embedVideo POST field contains a raw <script> tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.

AnalysisAI

Stored cross-site scripting in K2 extension for Joomla (versions 1.0-2.26) allows an authenticated Author-tier user to inject arbitrary JavaScript into the embedVideo POST field, which K2 stores verbatim and renders unescaped to every subsequent visitor of that article page. Any Joomla user granted K2 'create item' rights - the Author tier by default - can weaponize this to steal session cookies, redirect victims, or perform actions on behalf of any visitor including administrators. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with partial technical impact.

Technical ContextAI

K2 (getk2.com) is a content construction kit extension for Joomla CMS, identified under CPE cpe:2.3:a:getk2.com:k2_extension_for_joomla:*:*:*:*:*:*:*:* and covering all versions from 1.0 through 2.26. The vulnerability is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant: the embedVideo field submitted via HTTP POST during article creation is not sanitized or encoded before being persisted to the database and subsequently reflected in HTML to visitors. Because the S:C (Scope Changed) component of the CVSS vector is set, the injected script executes in the security context of visiting browsers - distinct from the server's context - confirming this is a true cross-origin stored XSS. The root cause is the absence of output encoding on a user-controlled field at render time, a classic CWE-79 failure mode.

RemediationAI

No vendor-released patched version has been independently confirmed in the available intelligence; the only reference pointing to the vendor is the homepage https://www.getk2.org/, which should be consulted for any updated K2 release addressing this CVE. Until a patch is confirmed, administrators should apply the following compensating controls: restrict K2 'create item' rights to only fully trusted users and remove the Author-tier default grant for this permission, accepting the trade-off of reduced content contributor capacity. Additionally, a web application firewall rule blocking raw HTML tags (specifically script, iframe, and event handler attributes) in the embedVideo POST parameter can mitigate exploitation at the perimeter without disrupting other K2 functionality. Enabling Joomla's built-in text filter policies to strip HTML from article fields submitted by Author-tier users provides a host-side control, though it may interfere with legitimate embed code. Monitor K2's official changelog at https://www.getk2.org/ for a patched release and prioritize upgrade upon availability.