It has been discovered that the extension "Formhandler" (formhandler) is susceptible to Cross-Site Scripting.
Release Date: May 27, 2016
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: version 2.3.0 and below
Vulnerability Type: Cross-Site Scripting
Problem Description: The extension fails to properly sanitize user input and is vulnerable to Cross-Site Scripting.
Solution: Updated versions 2.3.1 and 2.0.2 are available from the TYPO3 Extension Manager and at <http://typo3.org/extensions/repository/download/formhandler/2.3.1/t3x/> and <http://typo3.org/extensions/repository/download/formhandler/2.0.2/t3x/>. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to Lubomir Stroetmann who discovered and reported the issue.