Based on the updated CVE description, the Joomla extension JMedia is vulnerable to a stored cross‑site scripting flaw that allows authenticated users to upload SVG files containing malicious scripts. The lack of sanitisation and the omission of the X‑Content‑Type‑Options: nosniff header mean that the payload is executed by any user that views the uploaded media, enabling attackers to steal credentials, deface content, or conduct session hijacking on the site. This weakness is classified as OWASP CWE‑79 and falls under the category of reflected and stored XSS attacks.

The vulnerability affects the JMedia extension for Joomla provided by themexpert.com. All versions prior to 1.6.0 are impacted. The threat is limited to installations that have the extension enabled and permit authenticated users to upload media files.

This flaw carries a CVSS score of 9.4, indicating a critical severity. An EPSS score of < 1% indicates a very low but nonzero exploitation probability, while the lack of mitigations such as nosniff enables straightforward exploitation once the attacker logs in. The vulnerability is not listed in the CISA KEV catalog. The most likely attack path involves an attacker logging in with legitimate credentials, uploading a crafted SVG file, and then enticing other users to view the file, thereby achieving browser‑side code execution.