Wallos versions from 4.4.0 up to but not including 5.10.3 contain a stored cross-site scripting (XSS) vulnerability in the sendnotifications.php endpoint. This flaw allows registered users to inject malicious scripts through unescaped notification service responses. An attacker can exploit this by directing Mattermost webhook URLs or Web Push endpoints to a server under their control that returns JavaScript. When an administrator opens sendnotifications.php, the injected script executes in their session, potentially compromising confidentiality and integrity.