Medium severity · published Sep 12, 2026
CVE-2026-89268
QloApps through 1.7.0 Reflected XSS via List Filter Parameters
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QL
QloApps · Webkul
through 1.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89268
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89268
patch
https://github.com/Qloapps/QloApps/pull/1801
patch
https://github.com/Qloapps/QloApps/commit/153ec1c8567798bd99155098ecc0a340e38f25bf
technical-description
https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/helpers/list/list_header.tpl
product
https://github.com/Qloapps/QloApps
third-party-advisory
https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-list-filter-parameters
More from QloApps
9.8
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution
7.5
CVE-2023-36284
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web…
7.2
CVE-2026-75498
Webkul QloApps SQL injection
7.2
CVE-2026-75497
Webkul QloApps SQL injection
7.2
CVE-2026-75496
Webkul QloApps improper file upload validation