MyNews version 1.6.x suffers from HTML and Javascript injection vulnerabilities allowing for cross site scripting attacks.