The vulnerability arises from the AdminSearchConfController->processSave() method echoing rejected alias and search values without proper escaping in validation error messages. Attackers can trigger the flaw by causing an authenticated back‑office user to submit a crafted request, resulting in arbitrary JavaScript execution within the user's administrative session. This cross‑site scripting flaw (CWE‑79) allows the attacker to steal session cookies, deface the admin interface, or redirect the user to malicious sites.

The issue affects Webkul’s QloApps product, versions 1.7.0 and earlier. Users running these releases have an unescaped path in the validation error handling of the admin search configuration page.

The CVSS score of 5.1 indicates a moderate risk. EPSS data is not available and the vulnerability is not listed in KEV, suggesting it is not widely exploited yet. The attack would require the victim to first be authenticated as an admin and to submit a special request; therefore the vector is limited to targeted, authenticated users. Nonetheless, because the flaw runs user‑supplied script in a privileged session, it poses a significant threat and should be addressed immediately.