EUVD-2026-88435
GHSA-rm64-rq7m-j69j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious property-detail review URL with title payload
-
DeliveryDeliver link to victim via phishing
-
ExploitVictim loads page, title reflected unescaped
-
ExecutionScript breaks out of attribute and executes
-
ImpactSteal session/perform actions in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted link to the public property-detail page's 'leave a review' form, whose title field is echoed directly from the request into a double-quoted HTML attribute with no escaping or filtering (unlike the adjacent comment field, which receives partial tag-stripping). No authentication is needed (PR:N), but the reflected nature means it is not self-triggering: it depends on user interaction (UI:P) - a user must load the malicious URL - and on the Real Estate Manager (Free) extension being installed and the review form being publicly reachable. Impact is confined to the tricked user's browser session; there is no server-side compromise. |
| Impact | This is a genuine but low-severity issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:L/VI:L/VA:L) describes network-reachable, low-complexity, unauthenticated exploitation that nonetheless requires victim interaction (UI:P) - a target must load an attacker-crafted link - which caps real-world impact and matches a reflected (non-persistent) XSS. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three exploitation-probability signals are absent rather than elevated; there is no evidence of active or automated exploitation. The 5.3 base score is vendor/reporter-sourced (Joomla/OrdaSoft) with no NVD-enriched CVSS 3.1 vector to cross-check. Net: a legitimate reflected XSS worth patching but not an emergency - impact is limited to a single tricked user's browser session against a niche third-party Joomla extension, so this is a high-plausibility, low-real-risk item rather than a priority. Note the vendor set VA:L (availability) for an XSS, which is arguable; a pure reflected XSS typically has no availability impact. |
| Exploit ScenarioDerived | An attacker crafts a URL to a site's public property-detail 'leave a review' page with a title query parameter containing a double-quote to break out of the HTML attribute followed by a <script> payload. The attacker sends this link to a victim (phishing/social) and, when the victim loads it, the injected script executes in their browser in the site's context, enabling session-cookie theft or actions as that user. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Reflected cross-site scripting in the ordasoft.com Real Estate Manager (Free) extension for Joomla before version 6.7.9 lets remote attackers execute arbitrary script in a victim's browser by luring them to a crafted URL. The flaw lives in the 'leave a review' form on the public property-detail page, where the review title is echoed from the request straight into a double-quoted HTML attribute with no escaping or filtering at all - a double-quote character in the title parameter breaks out of the attribute and permits a following <script> element to run. No authentication is required and the CVSS 4.0 base score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation depends on the victim loading the malicious link, so it is not self-triggering, and no public exploit code was identified at time of analysis. Impact is contained to the tricked user's browser session, with no server-side compromise; this is a genuine but low-severity issue.
RemediationAI
The primary fix is to upgrade the Real Estate Manager (Free) extension for Joomla to version 6.7.9 or later, the first release outside the stated vulnerable range; after updating, verify the installed build number in Joomla's extension manager rather than relying on the update notice alone, and consult the vendor at https://www.ordasoft.com/ for the authoritative package, since no dedicated advisory link was provided in the available intelligence. If the update cannot be applied immediately, practical compensating controls include temporarily unpublishing the review form or the property-detail review component so the vulnerable title parameter is no longer rendered (side effect: visitors lose the ability to leave reviews); deploying a WAF or reverse-proxy rule that blocks or encodes requests containing a double-quote character, percent-encoded %22, or angle brackets in the review-title parameter (side effect: possible false positives on legitimate titles containing quotation marks, and the rule requires tuning to the exact parameter name); and restricting the review endpoint to authenticated or trusted traffic (side effect: changes public-site behavior and may break legitimate anonymous reviews). Note that output-encoding fixes depend on the vendor's template changes and cannot be safely patched by end users in the extension code; because exploitation requires the victim to load a crafted link, user awareness and link scrutiny reduce exposure but are not a substitute for upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-79 improper neutralization of input during web page generation, specifically the reflected (non-persistent) variant, in a third-party Joomla extension published by ordasoft.com. On the public property-detail page, the 'leave a review' form repopulates its title field directly from the incoming request with no escaping routine and no input filtering of any kind; by contrast, the adjacent comment field on the very same form at least receives partial tag-stripping, which is why only the title parameter provides the breakout. Because the value is interpolated into a double-quoted HTML attribute, supplying a " character terminates the attribute early and allows attacker-controlled markup - such as a <script> element - to be parsed and executed as part of the page. The affected component is identified by CPE cpe:2.3:a:ordasoft.com:real_estate_manager_(free)_extension_for_joomla:*:*:*:*:*:*:*:*; the wildcard version fields mean the CPE alone does not pin the vulnerable range, which instead comes from the vendor's own advisory guidance that releases below 6.7.9 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reachability, low attack complexity, no attack requirements, no privileges required, and passive user interaction - consistent with the independent assessment that the victim must open an attacker-crafted link and that the Real Estate Manager (Free) extension must be installed with its review form publicly reachable.
Know when Real Estate Manager Free Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable unauthenticated reflected XSS requiring victim link-click (UI:R); executes in victim browser across a security boundary (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB