Actually in the 4th post i believe. he is correct. You can Use an XSS flaw in some 3.6X versions of vBulletin