Cross-site scripting vulnerability in L-Forum 2.40 and earlier when the \Enable HTML in messages\ option is off allows remote attackers to insert arbitrary script or HTML via message fields including (1) From (2) E-Mail and (3) Subject.