CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
Remote attackers can inject scripts via the price parameter in QloApps, executing JavaScript in authenticated back-office sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-110219?
CVE-2026-110219 is a medium-severity cross-site scripting vulnerability in Webkul QloApps, published on 13 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.
Weakness: CWE-79
Which versions are affected by CVE-2026-110219?
How do I fix CVE-2026-110219?
No fix has been published for CVE-2026-110219 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-110219 being exploited?
There is no known exploitation of CVE-2026-110219 in the wild and no public exploit code.
Sources
Also known as GHSA-v6h8-58w7-hfwh.