XSS Injection vulnerabilities.

The Vulnerabilities are in ACP's Usergroup module.
You can use scripts, meta etc. tags in Star Image's URL.
Moreover, you can also do it with Namestyle Username when you adding a
new group.
I have fixed this.