WALLOS · CVE-2026-126778 · Other
NO FIX YET · SEE WHAT TO DO
Wallos, a self-hosted subscription tracker, fails to escape responses from notification services in sendnotifications.php, so a registered user can store JavaScript that runs when an administrator opens that page. The attacker gets the administrator's session, which can expose or change data in the app.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Wallos 4.4.0 up to 5.10.3 with user registration open to people they do not fully trust. The attacker needs a registered account and must get an administrator to open sendnotifications.php, so instances limited to trusted users are at lower risk.
Not affected if managed-hosting, no-untrusted-registration, version-5.10.3-or-later
Who cares php, self-hosted, wallos
4.4.0 up to but not including 5.10.3endpoints/cronjobs/sendnotifications.php file and confirm whether it outputs notification service responses unescaped5.10.3 or laterWallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.