XenForo versions 1.4.9 and below suffer from a cross site scripting vulnerability.