{"id":"CVE-2026-48942","aliases":["EUVD-2026-39439","GHSA-5hmf-7m33-2v23"],"status":"published","title":"Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla \u003c 2.26","description":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00253,"percentile":0.169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-06-25T15:23:38Z","modified":"2026-10-25T22:10:00Z","products":[{"vendor":"getk2.com","product":"k2 extension for joomla"},{"vendor":"getk2.org","product":"k2 extension for joomla"},{"vendor":"joomlaworks","product":"k2"}],"references":[{"url":"https://www.getk2.org/","tags":["product","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48942"},{"url":"https://www.getk2.org"},{"url":"https://github.com/advisories/GHSA-5hmf-7m33-2v23"}],"sources":{"cve":[{"id":"CVE-2026-48942","title":"Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla \u003c 2.26","description":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.","status":"published","published":"2026-06-25T15:23:38.156Z","modified":"2026-06-28T18:29:05.078Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-39439","description":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.","status":"published","published":"2026-06-25T15:23:38Z","modified":"2026-06-28T18:29:05Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-5hmf-7m33-2v23","title":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two...","description":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.","status":"published","published":"2026-06-25T18:30:39Z","modified":"2026-06-25T18:30:47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:08:59.328511Z"}],"nvd":[{"id":"CVE-2026-48942","description":"K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.","status":"published","published":"2026-06-25T16:16:36.617Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:26.045561Z"}]}}