A reflected cross‑site scripting vulnerability exists in QloApps 1.7.0 and earlier. The back‑office "Additional Facilities" form accepts a price value that is not properly escaped before being re‑rendered when validation fails. An attacker can create a crafted request containing malicious JavaScript that, when executed in the context of an authenticated administrative session, can hijack that session, steal cookies, or perform unwanted actions on behalf of the user. The weakness is identified as CWE‑79.

The issue affects the Webkul QloApps software up to and including version 1.7.0. Any installation that has the "hotelreservationsystem" module with the vulnerable "Additional Facilities" form is potentially exposed.

The CVSS base score is 5.1, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to convince an authenticated back‑office user to submit a malicious request, or the attacker must directly send the crafted request if they have back‑office credentials. The vulnerability is thus primarily a cross‑site scripting risk that could lead to session hijacking or privilege escalation within the administrative interface.