XSS in Ellite Wallos
CVE-2026-30841
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> with…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.000 (4.2th percentile) — read the EPSS interpretation.
Affected products
- Ellite Wallos — versions < 4.6.2
Weakness classification (CWE)
References
- https://github.com/ellite/Wallos/security/advisories/GHSA-75hc-fc26-9797 (x_refsource_CONFIRM)
- https://github.com/ellite/Wallos/commit/e8a513591dbbf885966e2ef55c38622785b9060d (x_refsource_MISC)
- https://github.com/ellite/Wallos/releases/tag/v4.6.2 (x_refsource_MISC)