A stored XSS flaw exists in the donor avatar mouse‑over text feature of GazellePW (GazellePosterWall). Authenticated users can submit arbitrary JavaScript via the avatar_mouse_over_text parameter; the input is stored and later rendered in an avatar tooltip. When a visitor triggers the tooltip, the browser executes the injected script, which can steal cookies, hijack sessions, or deface the site.

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449. No official patch or version range is listed, but the flaw resides in this specific code base and requires an authenticated user who can modify the avatar tooltip text.

The vulnerability is exploitable by any authenticated user who can submit the malicious text, making exploitation straightforward from the web interface. The CVSS base score of 5.4 indicates moderate severity. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog. Nonetheless, the potential impact of client‑side code execution warrants prompt attention, as the flaw can compromise user accounts and manipulate site content, though it requires the victim to view the tooltip.