K2 Joomla! extension versions prior to 2.7.1 suffer from a cross site scripting vulnerability.