CVE-2026-60034 is a stored cross-site scripting vulnerability in the JMedia extension for Joomla, caused by improper neutralization of input during web page generation (CWE-79). Specifically, unsanitized SVG uploads are served without the 'nosniff' header, allowing attackers to inject malicious scripts that execute in the context of the affected web application. This vulnerability affects versions from 1.0 up to and including 1.5.4 of the JMedia extension. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users viewing the affected content. This can lead to session hijacking, defacement, or other malicious actions performed in the context of the vulnerable Joomla site. The CVSS 4.0 score of 9.4 indicates a critical impact with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable SVG uploads in the JMedia extension and implement additional input sanitization and content security policies to mitigate the risk of XSS. Monitor vendor communications for updates on patches or official mitigations.