CVE-2026-48940 is a cross-site scripting vulnerability (CWE-79) in the K2 extension for Joomla. A user with 'create item' permissions (Author tier by default) can submit an article with a malicious <script> tag in the embedVideo POST field. The K2 extension stores this input verbatim and renders it unescaped on the article page, potentially allowing script execution in the context of visitors viewing the article. The vulnerability affects versions 1.0 through 2.26 of K2. No vendor advisory or patch is currently provided.

The vulnerability allows a user with limited content creation rights to inject arbitrary script code that will execute in the browsers of visitors to the affected article pages. This can lead to low-impact cross-site scripting attacks, such as session token exposure or UI manipulation, but does not affect confidentiality or availability directly. The CVSS score of 3.4 reflects the low severity and the requirement for user interaction and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict 'create item' permissions to trusted users only and consider disabling or limiting the embedVideo field usage. Monitor official getk2.org or Joomla advisories for updates.