CVE-2026-60034
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Joomla extension JMedia versions below 1.6.0 is vulnerable to stored cross-site scripting (XSS). Unsanitized SVG uploads served without the nosniff header allow an attacker to inject malicious scripts that execute in other users' browsers.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their account, threatening data confidentiality and integrity.
Recommendation
Update the JMedia extension to version 1.6.0 or later. Sanitize uploaded SVG files and add the X-Content-Type-Options: nosniff header.
Other vulnerabilities in JMedia
See all- CVE-2026-60032Critical
The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).
- CVE-2026-60033Medium
The JMedia extension for Joomla! versions below 1.6.0 is vulnerable to server-side request forgery (SSRF). The remote URL download functionality can be abused to target internal/reserved addresses.
Original NVD description (English source)
Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.