Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) dataContacttitle parameter to admin/contacts/contacts/add page; (2) dataBlocktitle or (3) dataBlockalias parameter to admin/blocks/blocks/edit page; (4) dataRegiontitle parameter to admin/blocks/regions/add page; (5) dataMenutitle or (6) dataMenualias parameter to admin/menus/menus/add page; or (7) dataLinktitle parameter to admin/menus/links/add/menu page.