This vulnerability allows a Joomla user with K2 'create item' permissions (typically Author tier) to inject arbitrary script code via the embedVideo POST field when submitting an article. The K2 extension does not properly neutralize this input, storing and rendering the script tag unescaped. This results in a cross-site scripting (CWE-79) vulnerability that can affect any visitor viewing the compromised article page.

An attacker with limited privileges (Author tier) can inject malicious JavaScript code that executes in the browsers of users viewing the affected article pages. This can lead to session hijacking, defacement, or other client-side attacks depending on the injected script. The vulnerability affects all visitors to the compromised content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict 'create item' permissions to trusted users only and consider disabling or restricting the embedVideo functionality if possible.