A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… (CVE-2026-38469)

The vulnerability is a stored XSS in GazellePW's custom bonus title feature, specifically in the handling of the title parameter in /bonus.php and /user.php?action=staff_tool. Authenticated users with access to these endpoints can inject malicious JavaScript that is stored and later executed in the context of other users. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction needed, and partial confidentiality and integrity impact without availability impact. No patch or remediation details are provided in the available data.

Successful exploitation allows remote authenticated users to inject and execute arbitrary JavaScript in the context of other users, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and authenticated access.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users and consider implementing input validation or output encoding as temporary mitigations.