< 2.6
2.6
iRedAdmin before 2.6 allows XSS, e.g., via order_name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.