Joomla iProperty Real Estate 4.1.1 has a reflected cross‑site scripting flaw that allows attackers to inject malicious JavaScript through the filter_keyword GET parameter of the all‑properties‑with‑map endpoint. When a victim follows a crafted URL, the injected script runs in the victim’s browser, enabling the attacker to steal session cookies, credentials, or perform other client‑side attacks.

The vulnerability affects Thethinkery’s Joomla iProperty Real Estate plugin, specifically version 4.1.1. No other versions are listed as affected in the available data.

The CVSS score of 5.1 indicates a moderate severity. Exploit probability data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires a victim to click a malicious link, making this a user‑interaction‑dependent threat. Successful exploitation can lead to compromise of confidentiality through credential theft or enabling further attacks on the host system.