= 2.7
TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.