CVE-2026-33400
Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.
| CWE | CWE-79 |
| Vendor | ellite |
| Product | wallos |
| Published | Mar 24, 2026 |
| Last Updated | Mar 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for ellite wallos
Be the first to know when new medium vulnerabilities affecting ellite wallos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
ellite / Wallos
< 4.7.0