Quick answers
- Is CVE-2026-60034 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60034 being exploited in the wild.
- How severe is CVE-2026-60034?
- Informational severity, with a CVSS score of 9.4, published 20 July 2026.
- Which products and versions are affected?
- ThemeXpert JMedia 1.0-1.5.4.
- Is there a fix for CVE-2026-60034?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-60034 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-60034?
- Check whether you run ThemeXpert JMedia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The JMedia extension for Joomla (versions 1.0 through 1.5.4) contains a stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitize uploaded SVG files and the lack of a 'X-Content-Type-Options: nosniff' header when serving these files. An attacker with high privileges (required for media uploads) can upload a malicious SVG containing embedded JavaScript. When other users, including administrators, view the file, the script executes in their browser context, potentially allowing for session hijacking or unauthorized administrative actions. The Joomla! Project has assigned a CVSS 4.0 score of 9.4.
Affected products
- ThemeXpert JMedia extension for Joomla 1.0-1.5.4
Timeline
- 2026-07-20: advisory: CVE-2026-60034 published by NVD