XSS in Themexpert.com Jmedia Extension For Joomla
CVE-2026-60034
Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.
Affected products
- Themexpert.com Jmedia Extension For Joomla — versions 1.0-1.5.4
Weakness classification (CWE)
References
- security@joomla.org (product)