CVE-2026-100753: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Anyone who loads a crafted link to a public property-detail page with the “leave a review” form can be affected. Exploitation occurs in the victim’s browser when the injected script executes.
What does an attacker need to exploit it?
The attacker needs to craft a link containing a malicious value in the title query parameter and persuade a victim to load it. No authenticated access is stated as necessary because the affected form is on a public property-detail page.
Which versions are affected?
Real Estate Manager (Free) versions earlier than 6.7.9 are affected.