Reflected Cross-Site Scripting in Real Estate Manager by Ordasoft
CVE-2026-100753

5.3MEDIUM

Key Information:

Vendor

Ordasoft.com

Status
Real Estate Manager (free) Extension For Joomla
Vendor
CVE Published:
28 September 2026

What is CVE-2026-100753?

The Real Estate Manager extension by Ordasoft is susceptible to a reflected cross-site scripting vulnerability due to improper handling of user input in the 'leave a review' form. The title field of the review form directly incorporates data from the request without any filtering or escaping. This oversight allows attackers to inject malicious scripts into the title parameter, enabling the execution of unauthorized scripts in the browsers of users who access the manipulated links.

Affected Version(s)

Real Estate Manager (Free) extension for Joomla 1.0.0-6.7.8

References

https://www.ordasoft.com/
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ala Arfaoui
.