CVE-2026-60034 is a critical stored XSS vulnerability in the themexpert.com JMedia extension for Joomla versions 1.0 to 1.5.4. The issue stems from unsanitized SVG file uploads that are served without the 'nosniff' header, enabling attackers with authenticated access to inject malicious scripts that are stored and later executed in users' browsers. This vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 9.4, indicating high attack vector and impact metrics. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an authenticated attacker to inject and store malicious scripts via SVG uploads, which can execute in the context of users' browsers when the content is viewed. This can lead to session hijacking, privilege escalation, or other malicious actions impacting confidentiality, integrity, and availability of the Joomla site and its users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit SVG uploads, and consider disabling or restricting the JMedia extension usage. Implement web application firewall (WAF) rules to detect and block malicious SVG payloads if possible.