CVE-2026-103588 is a reflected cross-site scripting vulnerability in Webkul QloApps through version 1.7.0. The issue exists in the exceptions parameter of the back-office Transplant a module form, where input is not properly neutralized during web page generation. An attacker can embed a JavaScript payload in a crafted URL that executes in the context of an authenticated administrator's session upon visiting the link.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authenticated administrator's session, potentially leading to session hijacking or unauthorized actions within the administrative interface. However, exploitation requires the victim to be an authenticated administrator and to interact with a maliciously crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking suspicious links and consider restricting access to the back-office interface to trusted users only.