CVE-2026-38465: n/a

This vulnerability involves a stored XSS flaw in GazellePW's donor avatar mouse-over text feature. Authenticated users can inject malicious JavaScript through the avatar_mouse_over_text parameter, which is persistently stored and executed when the avatar tooltip is rendered. The CVSS vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of other users viewing the avatar tooltip, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires the attacker to be authenticated and involves user interaction to trigger the payload. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict or monitor the use of the avatar_mouse_over_text parameter by authenticated users if possible.