The vulnerability is a stored cross‑site scripting flaw in the custom bonus title feature of GazellePosterWall (commit 86c4bedf727691b5a97af42a4864869d18446449). Authenticated users with sufficient privileges can inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool. Based on the description, it is inferred that attackers could execute malicious scripts in the browsers of users who view the affected bonus page, enabling cookie theft, session hijacking, defacement, or malware delivery. The flaw stems from improper neutralization of input during web page generation.

GazellePosterWall (GazellePW) as of commit 86c4bedf727691b5a97af42a4864869d18446449. The issue exists in any instance of the software that has not applied the pending patch or updated to a subsequent commit that addresses the sanitization of the custom bonus title. No explicit vendor name is provided, but the source‑code repository indicates the product is a community‑maintained forum software.

The CVSS score is not available, and EPSS is not reported, so an exact numerical risk cannot be provided. Based on the description, it is inferred that the presence of a stored XSS that can be triggered by authenticated users suggests a high exploitation likelihood, especially in environments with active staff or privileged accounts. Attackers could craft payloads that run in the context of any user who views the bonus page, giving them access to session cookies or the ability to modify page content. Although the vulnerability is not listed in the CISA KEV catalog, the vector remains present and potentially exploitable.