≤ 1.8.9
Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.