vanillaforums/Garden — Issue #1311: Flagging plugin XSS vulnerability.
Author: ceol
Created: 2012-03-01 05:25:56+00:00
State: open

User input is not sanitized when submitting the flag description. If you were to flag a post with the reason

it will execute the JavaScript when an admin/moderator views the Flagged Content page. This has been found on Vanilla version 2.0.18.2 and Flagging version 1.1.0.