CVE-2026-89268mediumCWE-79

CVE-2026-89268: medium-severity vulnerability in Webkul QloApps

QloApps through 1.7.0 Reflected XSS via List Filter Parameters

Published · Updated

Follow this CVE+ Monitor QloApps

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
Webkul · QloApps
Related CVEs — Webkul QloApps

In the same product, most dangerous first.

CVE-2026-75496HIGHWebkul QloApps improper file upload validationEPSS 1.0%CVE-2026-75498HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2026-75497HIGHWebkul QloApps SQL injectionEPSS 0.8%CVE-2025-6173MEDIUMWebkul QloApps ajax_products_list.php sql injectionEPSS 0.6%CVE-2025-1155MEDIUMWebkul QloApps Your Location Search stores cross site scriptingEPSS 0.5%CVE-2025-10759MEDIUMWebkul QloApps CSRF Token authorizationEPSS 0.3%