| Package | Affected versions | Patched versions |
|---|---|---|
| k2 | ≤ 2.26 |
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free