vBulletin versions 3.7.1 and below and 3.6.10 and below suffer from an obscure cross site scripting vulnerability.