CVE-2026-103589 describes a reflected XSS vulnerability in Webkul QloApps through version 1.7.0. The issue is due to improper neutralization of input during web page generation in the back-office room type editor. Specifically, the fields room_num, floor, and comment are not escaped correctly within input attributes, enabling injection of malicious JavaScript code. Exploitation requires an attacker to induce an authenticated back-office user to submit a crafted POST request containing the payload, resulting in script execution in the victim's session.

Successful exploitation can lead to arbitrary JavaScript execution in the context of an authenticated back-office user's session. This may allow attackers to perform actions on behalf of the user, steal session tokens, or conduct other malicious activities within the administrative interface. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited impact on confidentiality and integrity.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the back-office interface to trusted users only and avoid submitting untrusted input in the vulnerable fields. Monitor vendor channels for updates and apply patches promptly when released.