It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
These problems present themselves when malicious HTML and script code is sent to the application through the 'page' parameter of several scripts.
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.
Goollery contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the conversation_id variable upon submission to the viewpic.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of confidentiality and/or integrity.
Upgrade to version 0.04b or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.