:Smasher has reported a vulnerability in Youtube Script, which can be exploited by malicious people to conduct cross-site scripting attacks.Input passed to the "lang[please_wait]" parameter in siteadmin/editor_files/includes/load_message.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.Solution:Edit the source code to ensure that input is properly sanitised.Provided and/or discovered by:SmasherOriginal Advisory:http://archives.neohapsis.com/archives/bugtraq/2008-02/0008.html

Original post by amit