CVE-2026-33400

MEDIUM

Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint

Title source: cna

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.

References (2)

[X_Refsource_Confirm] https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv

[X_Refsource_Misc] https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef

View Writeup ZIP pw:eip

Scores

CVSS v3 5.4

EPSS 0.0008

EPSS Percentile 22.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

ellite/Wallos < 4.7.0

wallosapp/wallos < 4.7.0

Published Mar 24, 2026

Tracked Since Mar 24, 2026