Cross-site scripting in ordasoft.com Real Estate Manager extension for Joomla
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ordasoft.com | Real Estate Manager (Free) extension for Joomla | 1.0.0-6.7.8 | — | No fix listed | CNA |
- Real Estate Manager (Free) extension for Joomla Vendorordasoft.com Affected 1.0.0-6.7.8 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ordasoft:real_estate_manager:*:*:*:*:free:joomla\!:*:* | before 6.7.9 | Vulnerable | ordasoft.com |
- cpe:2.3:a:ordasoft:real_estate_manager:*:*:*:*:free:joomla\!:*:* Versions before 6.7.9 Vulnerable ·ordasoft.com
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-100753
- 2026-10-03 Alias added: GHSA-rm64-rq7m-j69j
- 2026-10-27 CVSS score added · NVD
References
Other 1
More ordasoft.com Real Estate Manager vulnerabilities
- TI-2026-64893 SQL injection in ordasoft.com Real Estate Manager extension for Joomla CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-100753 · CVE Program
- CVE-2026-100753 · NVD
- FIRST EPSS
- GHSA-rm64-rq7m-j69j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences