CVE-2026-38469

Name of the Vulnerable Software and Affected Versions GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449

Description A Stored Cross-Site Scripting (XSS) issue exists in the custom bonus title feature. This allows remote authenticated users to inject arbitrary JavaScript through the title parameter in the '/bonus.php' and '/user.php?action=staff tool' endpoints. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way.

Recommendations Update GazellePW (GazellePosterWall) to a version including commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the '/bonus.php' and '/user.php?action=staff tool' endpoints or avoid using the title parameter until the update is applied.