CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature of GazellePW (GazellePosterWall) (commit 86c4bedf) allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool. The vulnerable sinks are located in users.class.p...