Reflected Cross-Site Scripting in QloApps by QloApps
CVE-2026-110221

5.1MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110221?

QloApps version 1.7.0 is susceptible to a reflected cross-site scripting vulnerability that occurs within the AdminHotelFeaturePricesSettings form. The vulnerability arises when the application fails to properly escape the feature_price_name and impact_value POST parameters after validation errors, allowing attackers to craft malicious links or auto-submit forms. If an authenticated back-office user interacts with these links, it could result in executing arbitrary JavaScript code within their administrative session, posing significant security risks.

Affected Version(s)

QloApps 0 <= 1.7.0

References

https://hackmd.io/@leediay/SyMoELioMx
third-party-advisory
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/ho...
technical-description
https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/ho...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.