[Maccrob]

Sorry, but there is a xss issue in VBExperience 4.0.4 GOLD. I think previous versions also have this vulnerability

Cross Site Scripting Example: 
xperience.php?go=ranking&order=asc&="><script>alert(1);</script>

Fast solution:

 find in xperience.php
$sortfield = unhtmlspecialchars($vbulletin->input->clean_gpc('r', 'sortfield', TYPE_NOHTML));

Replace with:
$sortfield = htmlspecialchars(unhtmlspecialchars($vbulletin->input->clean_gpc('r', 'sortfield', TYPE_NOHTML)));