The vulnerability occurs when passwordreset.php outputs the token and email GET parameters directly into HTML input attributes without escaping, enabling an attacker to inject JavaScript that will execute in the victim’s browser. The flaw is a reflected Cross‑Site Scripting weakness identified as CWE‑79.

Wallos, an open‑source personal subscription tracker by ellite, is affected in all releases prior to version 4.6.2. The issue was fixed in the 4.6.2 release and later. Users running older versions should verify their build and apply the update.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via a crafted link to the password reset page; no authentication or local access is required, making the attack vector inferred from the description.