CVE-2026-126778

MEDIUM 5.4

Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.php

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.

CWE	CWE-79
Vendor	ellite
Product	wallos
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for ellite wallos

Be the first to know when new medium vulnerabilities affecting ellite wallos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

ellite / Wallos

4.4.0 < 5.10.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ellite/Wallos/commit/693d8676f3e5b0c85e120fc5958ccb82f37ee89c github.com: https://github.com/ellite/Wallos/releases/tag/v5.10.3 github.com: https://github.com/ellite/Wallos/blob/v5.10.2/endpoints/cronjobs/sendnotifications.php#L813-L816 github.com: https://github.com/ellite/Wallos/blob/v4.4.0/endpoints/cronjobs/sendnotifications.php#L641-L642 vulncheck.com: https://www.vulncheck.com/advisories/wallos-4.4.0-before-5.10.3-stored-xss-via-sendnotifications-php

Credits

Zachariah Mithani (AploSec)