CVE-2025-1155: Webkul QloApps Your Location Search stores cross site scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-02-10 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term.

Affected products

Webkul QloApps: 1.6.1

References

https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main
https://vuldb.com/?ctiid.295059
https://vuldb.com/?id.295059
https://vuldb.com/?submit.492777
https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main

Get alerted when CVE-2025-1155 or the next vulnerability affects your stack