Lucidcrew

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `groupid` parameter in an "editgroup" action or the `usergroup id` parameter in an "edit usergroup" action.

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `groupid` parameter in an 'addforum' action to 'wp-admin/admin.php'.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `groupid` parameter in an "editgroup" action.