CVE-2026-38472

GazellePW (GazellePosterWall) contains a Stored XSS vulnerability in its forum reward comments feature, identified at commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote attackers can inject arbitrary JavaScript through the c parameter in /forums.php?action=ajax_get_jf. The injected payload ...