Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) dataCategorytitle parameter to admin/categories/add (2) dataFieldtitle parameter to admin/fields/ajax_fields/ (3) name property in a basicInfo JSON object to admin/tools/create_theme (4) dataLinklink_title parameter to admin/links/links/add or (5) dataForumTopicsubject parameter to forums/off-topic/new.