JoomlaUX JUX Real Estate Cross-Site Scripting Vulnerability in Agent Registration Functionality

A cross-site scripting (XSS) vulnerability has been identified in JoomlaUX JUX Real Estate version 3.4.0. The issue arises in the agent registration feature, specifically within the file '/extensions/realestate/index.php/agents/agent-register/addagent'. The vulnerability is triggered by manipulating the 'plan_id' argument, allowing for remote exploitation. This issue has been publicly disclosed, and the vendor was notified but did not respond.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.