The Real Estate Manager (Free) extension for Joomla (versions 1.0.0 to 6.7.8) contains a reflected XSS vulnerability (CWE-79) in the 'leave a review' form on the public property-detail page. Specifically, the title field is populated directly from the request parameter without any escaping or filtering, enabling injection of arbitrary HTML and script code. A malicious actor can craft a URL with a title parameter containing a double quote character to break out of the HTML attribute context and insert a <script> element, which executes in the victim's browser when the link is loaded. This vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and does not require privileges or authentication to exploit, but does require user interaction.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected website for users who click on a crafted link. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the victim's browser. The vulnerability affects all users who visit the vulnerable page with the malicious payload in the title parameter. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on suspicious links containing unexpected parameters in the title field of the 'leave a review' form. Website administrators should monitor for updates from ordasoft.com and apply official patches once released. No official fix or patch links were provided in the available data.