Stored Cross-Site Scripting Vulnerability in Wallos by El-ite

CVE-2026-126778

What is CVE-2026-126778?

Wallos versions up to 4.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the sendnotifications.php script. This vulnerability allows authenticated users to execute malicious scripts via unescaped notification service responses. By leveraging this flaw, attackers can direct their Mattermost webhook URL or Web Push endpoint to a malicious server, enabling them to execute JavaScript in the context of an administrator’s session upon accessing sendnotifications.php. Users are encouraged to update to version 5.10.3 or later to mitigate this vulnerability.

References