The vulnerability is a reflected cross‑site scripting (XSS) flaw in the AdminHotelFeaturePricesSettings form of QloApps. When input validation fails, the feature_price_name and impact_value POST parameters are echoed back to the page without escaping. An attacker can embed malicious JavaScript in these parameters and trick an authenticated back‑office user into submitting the forged request, causing the script to run in the user’s administrative session. This allows the attacker to hijack the admin’s session, manipulate site data, or steal sensitive information.

The flaw exists in QloApps version 1.7.0 and any earlier releases. It affects the Webkul QloApps e‑commerce platform, specifically the hotelfeaturepricing module that renders advanced price rules. Administrators using the affected versions are at risk when they access the AdminHotelFeaturePricesSettings administrative page.

The vulnerability compiles to a moderate CVSS score of 5.1. The EPSS score of 0.00247 (0.247%) indicates a very low probability of exploitation, though it is not zero. Because the attack requires an authenticated administrator to submit a crafted request, an attacker can lure the user to click a malicious link or post an auto‑submitting form, which would then execute malicious JavaScript in the admin’s session. No KEV listing is observed, so no widespread exploitation has been reported to date, but the moderate severity and the possibility of credentialed attacks warrant timely remediation.