---
id: CVE-2026-100753
title: >-
  Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real
  Estate Manager (Free) < 6.7.9 -  The public property-detail page’s “leave a
  review” form repopulates its title field directly from the request with no
  escaping and …
summary: >-
  Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real
  Estate Manager (Free) < 6.7.9 -  The public property-detail page’s “leave a
  review” form repopulates its title field directly from the request with no
  escaping and …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-79
vendor: ordasoft.com
product: com_realestatemanager
affected:
  - com_realestatemanager 1.0.0-6.7.8
published: '2026-09-28'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T19:16:46.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100753'
references:
  - url: 'https://www.ordasoft.com/'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-28T19:19:07.729Z'
---

## Overview

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 -  The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.