A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the `Real name` field in Personal Settings, which is then presented to readers of articles, or through a file upload, such as uploading .htm, .html, or .js files.