CVE-2026-110219

MEDIUM 5.4

QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

CWE	CWE-79
Vendor	webkul
Product	qloapps
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for webkul qloapps

Be the first to know when new medium vulnerabilities affecting webkul qloapps are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Webkul / QloApps

0 ≤ 1.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/SyMoELioMx github.com: https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/room_type_global_demand/helpers/form/form.tpl#L208-L209 github.com: https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminRoomTypeGlobalDemand.php#L200-L232 github.com: https://github.com/Qloapps/QloApps/pull/1809 github.com: https://github.com/Qloapps/QloApps vulncheck.com: https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-additional-facility-price-field

Credits

leediay153 from Viettel Post