= 3.5
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.