avatar upload vulnerability:
upload any kind of file in:
and approuved or not it will be here :
same thing for : add link
xss permanent on Contact Us :
message & title fields are vulnerable to an xss attack.
this kind of xss are pretty dangerous, because you send the malicious message to an admin.
so you can get his cookie.
regards laurent gaffie