Vulnerability · Published Apr 9, 2026 · Assigned by VulnCheck

CVE-2023-54361Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword

Medium 6.1

In plain English

A medium-severity cross-site scripting in Joomla iProperty Real Estate from Thethinkery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the filter_keyword parameter. Attackers can craft URLs containing JavaScript payloads in the filter_keyword GET parameter of the all-properties-with-map endpoint to execute arbitrary code in victim browsers and steal session tokens or credentials.

Affected products (as reported)

Vendor	Product	Versions
Thethinkery	Joomla iProperty Real Estate	4.1.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

ExploitDB-51640 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword third-party-advisory