CVE-2026-33400: Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the walloslogin authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33400?
CVE-2026-33400 has a high severity due to the potential for stored cross-site scripting (XSS) attacks affecting user data.
How do I fix CVE-2026-33400?
To fix CVE-2026-33400, you should upgrade Wallos to version 4.7.0 or higher.
What are the implications of CVE-2026-33400?
The implications of CVE-2026-33400 include the risk of attackers executing scripts or code in the context of a user's session.
Who is affected by CVE-2026-33400?
Users of Wallos versions prior to 4.7.0 are affected by CVE-2026-33400.
Is there a known exploit for CVE-2026-33400?
As of now, there are no publicly known exploits specifically targeting CVE-2026-33400.