CVE-2026-110221
QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
Webkul QloApps
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.
Text from CVE List
Affected versions 1
- QloAppsaffected: all versions through 1.7.0CVE List
References 6
- hackmd.io/@leediay/SyMoELioMxAdvisoryvia CVE List
- vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-advanced-price-rule-name-and-impact-valueAdvisoryvia CVE List
- github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl#L43Referencevia CVE List
- github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_feature_prices_settings/helpers/form/form.tpl#L185Referencevia CVE List
- github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelFeaturePricesSettings.php#L401-L414Referencevia CVE List
- github.com/Qloapps/QloAppsReferencevia CVE List