Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 5.x allow remote attackers to inject arbitrary web script or HTML via the (1) cat (2) password (3) ppuser (4) sort or (5) si parameters to showgallery.php the (6) ppuser (7) sort or (8) si parameters to showmembers.php or (9) the photo parameter to slideshow.php.