CVE-2026-92234

MEDIUM 5.4

QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.

CWE	CWE-79
Vendor	webkul
Product	qloapps
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for webkul qloapps

Be the first to know when new medium vulnerabilities affecting webkul qloapps are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Webkul / QloApps

0 ≤ 1.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Qloapps/QloApps/pull/1796 github.com: https://github.com/Qloapps/QloApps/commit/54a3b30e4e5c2d6b224dc8fe55e75db173064b91 github.com: https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelfeaturesController.php hackmd.io: https://hackmd.io/@leediay/r1aoFrMFGl github.com: https://github.com/Qloapps/QloApps vulncheck.com: https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-hotel-feature-validation-errors

Credits

leediay153