CVE-2026-103587 is a reflected cross-site scripting vulnerability in Webkul QloApps through version 1.7.0. The flaw exists in the back-office Hotel Reservation System Book Now search functionality, where the date_to and id_room_type parameters are incorporated into template variables without input validation or sanitization. This allows an attacker to inject malicious JavaScript code that executes in the context of an authenticated administrator's session when the crafted link is accessed.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authenticated administrator's session. This can lead to session hijacking, unauthorized actions performed with administrator privileges, or other attacks relying on the administrator's elevated access. However, exploitation requires the victim to be an authenticated administrator and to interact with a maliciously crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links containing suspicious parameters in the affected application. Implementing input validation and output encoding on the affected parameters can mitigate the risk. Monitor vendor communications for official patches or updates.