CVE-2026-103590 is a reflected cross-site scripting vulnerability in Webkul QloApps through version 1.7.0. The flaw exists in the back-office room type editor where the length of stay fields (restriction_min_los and restriction_max_los) do not properly neutralize input during web page generation. An attacker can craft malicious POST requests that, when submitted by an authenticated administrator, execute arbitrary JavaScript in the administrator's session context.

Successful exploitation allows execution of arbitrary JavaScript code in the context of an authenticated administrator's session, potentially leading to session hijacking, unauthorized actions, or other attacks within the administrative interface. The vulnerability requires authenticated administrator interaction and user interface involvement.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access, avoid submitting untrusted input in the affected fields, and monitor for suspicious activity.