XSS Injection vulnerabilities.

A vulnerabilities are in ACP's Usergroup module.
You can use scripts, meta etc. in Star Image's URL.
Moreover, you can do it also with Namestyle Username when you adding a
new group.
I fixed this.