# CVE-2026-126778: Wallos stored cross-site scripting in notification service

Source: https://junglewise.ai/threats/cve-2026-126778-wallos-4-4-0-before-5-10-3-contains-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126778 · Severity: medium · CVSS 5.4 · Published 2026-11-11

Wallos is a personal finance application used to track subscriptions. A stored cross-site scripting vulnerability in versions 4.4.0 through 5.10.2 allows registered users to inject malicious JavaScript by configuring webhook URLs or push endpoints that return script code. When administrators access the notification sending page, the injected scripts execute in their browser session, potentially allowing attackers to steal session tokens, modify settings, or perform actions as the administrator.

## Quick answers

**Is CVE-2026-126778 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126778 being exploited in the wild.

**How severe is CVE-2026-126778?** Medium severity, with a CVSS score of 5.4, published 11 November 2026.

**Which products and versions are affected?** Wallos 4.4.0 through 5.10.2.

**Is there a fix for CVE-2026-126778?** Yes: fixed in 5.10.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126778 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126778?** Check whether you run Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.10.3

## Technical details

The vulnerability exists in endpoints/cronjobs/sendnotifications.php where notification service responses from Mattermost webhooks or Web Push endpoints are not properly escaped before display. A registered user can inject malicious JavaScript by pointing a webhook URL to a controlled server that returns executable code. The injected payload is stored and executed in the administrator's session when they access the affected page.

## Affected products

- Wallos 4.4.0 through 5.10.2

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/ellite/Wallos/blob/v4.4.0/endpoints/cronjobs/sendnotifications.php](https://github.com/ellite/Wallos/blob/v4.4.0/endpoints/cronjobs/sendnotifications.php)
- [https://github.com/ellite/Wallos/blob/v5.10.2/endpoints/cronjobs/sendnotifications.php](https://github.com/ellite/Wallos/blob/v5.10.2/endpoints/cronjobs/sendnotifications.php)