CVE-2026-38472

Name of the Vulnerable Software and Affected Versions GazellePW (GazellePosterWall) versions up to commit 86c4bedf727691b5a97af42a4864869d18446449

Description A stored cross-site scripting (XSS) issue exists in forum reward comments. A remote attacker can inject arbitrary JavaScript through the c parameter in the '/forums.php?action=ajax get jf' endpoint. This injected content is subsequently rendered within the data-tooltip attribute in the '/forums.php?action=viewthread' endpoint and interpreted as HTML due to the Tooltipster configuration.

Recommendations Update GazellePW (GazellePosterWall) to a version beyond commit 86c4bedf727691b5a97af42a4864869d18446449. Avoid using the c parameter in the '/forums.php?action=ajax get jf' endpoint until the software is updated.