Hi, I found a relfected XSS in the account_prof_edit_page.php-line: 100, the variable $f_redirect_page will be output without the function string_attrribute() protected.
version: 2.24.3
path: account_prof_edit_page.php
sink: line-100 <input type="hidden" name="redirect" value="<?php echo $f_redirect_page ?>" />
source: line-63 $f_redirect_page = gpc_get_string( 'redirect', 'account_prof_menu_page.php' );
fix: string_attribute($f_redirect_page)