CVE-2026-38472: n/a

This vulnerability is a stored XSS in GazellePW's forum reward comments functionality. Specifically, the 'c' parameter in the AJAX endpoint /forums.php?action=ajax_get_jf is not properly sanitized, allowing injection of arbitrary JavaScript. The injected code is stored and subsequently rendered inside the data-tooltip attribute on the forum thread view page, where it is interpreted as HTML by the Tooltipster configuration, leading to script execution in users' browsers. The CVSS 3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of users viewing the affected forum threads. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, users should exercise caution when interacting with forum reward comments and consider disabling or restricting the affected functionality if possible.