Wallos is an open‑source, self‑hosted personal subscription tracker. A stored cross‑site scripting flaw exists in the payment method rename endpoint that allows any authenticated user to inject arbitrary JavaScript. The injected code runs when other users visit Settings, Subscriptions, or Statistics pages, giving the attacker the ability to steal or manipulate session data. Combined with the wallos_login cookie lacking the HttpOnly flag, successful exploitation can lead to full session hijacking.

The vulnerability affects all versions of ellite:Wallos, specifically the Wallos application, before version 4.7.0. Users of any earlier release are exposed. No specific sub‑versions are listed.

The flaw has a CVSS v3 score of 5.4, placing it in the moderate range, and an EPSS score of less than 1 %, indicating a low probability of exploitation. The vulnerability requires an authenticated user to trigger the rename action, so only users with valid credentials can exploit it. Because the injected code executes in another user's browser, legacy JavaScript could harvest the session cookie. The combination of stored XSS and a non‑HttpOnly authentication cookie enables complete session hijacking. The vulnerability is not currently listed in the CISA KEV catalog.