CVE-2026-100753: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-10-27
Weakness: CWE-79

Description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.

Affected products

Ordasoft Real Estate Manager: before 6.7.9 — fixed in 6.7.9
ordasoft.com Real Estate Manager (Free) extension for Joomla: 1.0.0-6.7.8

How to fix

Upgrade to a fixed version: Ordasoft Real Estate Manager 6.7.9. Check the vendor advisory for mitigations.

References

https://www.ordasoft.com/

Get alerted when CVE-2026-100753 or the next vulnerability affects your stack