CVE-2026-38469: n/a

This vulnerability involves stored XSS in GazellePW's custom bonus title feature, specifically in the title parameter handled by /bonus.php and /user.php?action=staff_tool. Authenticated users can inject malicious JavaScript that is stored and later executed in the context of other users. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation could allow an authenticated attacker to execute arbitrary JavaScript in the context of other users, potentially leading to session hijacking, information disclosure, or other client-side impacts. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires authentication and user interaction.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected features to trusted users and consider additional input validation or output encoding as temporary mitigations.