2.2.7 Cross Site Scripting Vulnerability

[fgeek]

http://seclists.org/bugtraq/2015/Mar/15

[halamix2]

I'll publish Search.php fix shortly but I were unable to reproduce POST XSS in profile.php
( I'm not sure if it wasn't fixed in this commit ).
Edit: I see it now

[fgeek]

CVE-2015-2217 has been assigned for this issue. Please use it in your ChangeLog when releasing new version, thanks. Could you create new release with this fix, thanks?

[phpcodex]

I'll have a look in to this issue, it would need confirming that it is fixed before we release the next version.