A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote… (CVE-2026-38472)

This vulnerability (CVE-2026-38472) is a stored XSS flaw in GazellePW's forum reward comments. Attackers can supply malicious JavaScript through the 'c' parameter in an AJAX request, which is stored and later rendered unsafely in a tooltip attribute on forum thread views. The Tooltipster configuration interprets this attribute as HTML, enabling script execution in users' browsers. The CVSS 3.1 score is 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. No known exploits in the wild or patches are currently documented.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of users viewing the affected forum threads. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the confidentiality and integrity of user data. There is no direct impact on system availability. The vulnerability requires user interaction to trigger the malicious script.

No official patch or remediation has been documented for this vulnerability. Users and administrators should monitor vendor advisories for updates. Until a fix is available, consider implementing input validation or output encoding on the 'c' parameter to prevent script injection. Additionally, disabling or reconfiguring Tooltipster to not interpret tooltip content as HTML may mitigate exploitation risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.