Stored XSS Vulnerability in Wallos Payment Method for Open-Source Personal Subscription Tracker
CVE-2026-33400

5.4MEDIUM

Key Information:

Vendor

Ellite

Status
Wallos
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33400?

Wallos, an open-source personal subscription tracker, has a stored cross-site scripting (XSS) vulnerability in its payment method rename endpoint prior to version 4.7.0. This allows authenticated users to inject malicious JavaScript, which executes for any visitor accessing the Settings, Subscriptions, or Statistics pages. Additionally, the absence of the HttpOnly flag on the wallos_login authentication cookie permits attackers to hijack user sessions. Users are advised to upgrade to version 4.7.0 to mitigate this issue.

Affected Version(s)

Wallos < 4.7.0

References

https://github.com/ellite/Wallos/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ellite/Wallos/commit/e87387f0ebb540cd3...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.