Wallos: Stored cross-site scripting via notification service responses
Summary
Wallos, a self-hosted subscription tracker, contains a stored cross-site scripting vulnerability in its notification cron endpoint sendnotifications.php. A registered user can set a Mattermost webhook URL or Web Push endpoint to a server that returns JavaScript, and the script is then executed in the administrator's session when an administrator opens that page. The fix is in version 5.10.3.
Affected
- Wallos 4.4.0 up to but not including 5.10.3
- Earlier versions: Unknown.
Fixed in
- Fixed in Wallos 5.10.3 (fix commit 693d8676). Later release 5.11.1 is also available.
Workaround
- No vendor-published workaround. Until patched, restrict user accounts and review notification settings for unfamiliar webhook or push endpoints.
- Do not open the notification cron endpoint in a browser session while untrusted accounts may have configured notifications.
Exploitation
- Exploitation in the wild: no evidence found.
- Public proof of concept: none found.
- Attack requires a registered account and an administrator opening sendnotifications.php.
Our recommendation
- Update Wallos to version 5.10.3 or later (for example the latest release).
- Check whether Wallos is reachable from the internet and restrict access where possible.
- Review user accounts and notification settings for unknown webhook or push endpoints.
- Avoid opening administrative cron endpoints in a browser until the update is applied.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official advisory (VulnCheck) www.vulncheck.com
- Fix commit 693d8676 github.com
- Wallos release v5.10.3 github.com
- Vulnerable code at v4.4.0 github.com
- Vulnerable code at v5.10.2 github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:48.
Original description (NVD)
Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.
NVD references (5)
- https://github.com/ellite/Wallos/blob/v4.4.0/endpoints/cronjobs/sendnotifications.php#L641-L642
- https://github.com/ellite/Wallos/blob/v5.10.2/endpoints/cronjobs/sendnotifications.php#L813-L816
- https://github.com/ellite/Wallos/commit/693d8676f3e5b0c85e120fc5958ccb82f37ee89c
- https://github.com/ellite/Wallos/releases/tag/v5.10.3
- https://www.vulncheck.com/advisories/wallos-4.4.0-before-5.10.3-stored-xss-via-sendnotifications-php
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.