Is CVE-2026-100753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100753 being exploited in the wild.

How severe is CVE-2026-100753?

Informational severity, published 28 September 2026.

Which products and versions are affected?

OrdaSoft Real Estate Manager below 6.7.9.

Is there a fix for CVE-2026-100753?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100753 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100753?

Check whether you run OrdaSoft Real Estate Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100753: OrdaSoft Real Estate Manager reflected cross-site scripting

CVE-2026-100753 · Severity: info · Published 2026-09-28

The Real Estate Manager Joomla extension, which allows property websites to display listings and collect visitor reviews, contains a flaw in its review form that allows attackers to inject malicious scripts. An attacker can craft a deceptive link that, when clicked by a potential buyer or seller viewing a property listing, executes code in their browser to steal credentials, redirect them to phishing sites, or perform actions on their behalf.

Vendors: OrdaSoft.

Quick answers

Is CVE-2026-100753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100753 being exploited in the wild.
How severe is CVE-2026-100753?: Informational severity, published 28 September 2026.
Which products and versions are affected?: OrdaSoft Real Estate Manager below 6.7.9.
Is there a fix for CVE-2026-100753?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100753 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100753?: Check whether you run OrdaSoft Real Estate Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the property-detail page's review form title field, which directly reflects user input without HTML escaping or filtering. An attacker can break out of the HTML attribute context using a quote character and inject a script element. Unlike the adjacent comment field which applies partial tag-stripping, the title field has no protection, allowing arbitrary JavaScript execution in the victim's browser.

Affected products

OrdaSoft Real Estate Manager below 6.7.9

Timeline

2026-09-28: disclosed

References

https://www.ordasoft.com/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.