Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField (2) email (3) form_name (4) password (5) realname (6) repeatPassword or (7) username parameters to Oxwall/join; (8) captcha (9) email (10) form_name (11) from or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged (15) Oxwall/photo/viewlist or (16) Oxwall/video/viewlist.