Wallos is an open-source, self-hostable personal subscription tracker.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 24, 2026 · NIST NVD

   Detected

   Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOn

2. Jun 17, 2026 · NIST NVD

   Updated

   Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOn

Affected

• cpe wallosapp/wallosversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33400

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33400

  Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits t

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com