CVE-2026-110224: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Webkul QloApps

CVE-2026-110224 is a reflected XSS vulnerability in Webkul QloApps through version 1.7.0. The vulnerability exists in the AdminSearchConfController::processSave() method, where input values for alias and search are not properly neutralized before being included in validation error responses. This allows an attacker to craft a request that causes execution of malicious JavaScript in the context of an authenticated administrative user, potentially compromising the administrative session.

Successful exploitation allows execution of arbitrary JavaScript in the context of an authenticated back-office user's session. This can lead to session hijacking, unauthorized actions performed with administrative privileges, or other attacks leveraging the administrative session context. The vulnerability requires user interaction (the admin must submit the crafted request) and low attack complexity. The CVSS 4.0 base score is 5.1, indicating medium severity.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when handling input in the affected functionality and consider restricting access to the administrative interface to trusted users only.