A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit… (CVE-2026-38465)

The vulnerability in GazellePW allows remote authenticated users to perform stored XSS attacks by injecting malicious JavaScript code through the avatar_mouse_over_text parameter. This input is stored and subsequently rendered in the avatar tooltip, enabling script execution in the context of other users viewing the avatar. The flaw is identified as CWE-79 and tracked as CVE-2026-38465. There is no information about affected versions or available patches.

Successful exploitation could lead to limited confidentiality and integrity impacts by executing arbitrary JavaScript in the context of users viewing the affected avatar tooltip. There is no reported impact on availability. The attacker requires authentication to exploit this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and consider disabling or sanitizing the avatar_mouse_over_text feature to prevent injection of malicious scripts.