$_GET['submenu'] is not escaped.

`ShareaholicAdmin

Name field in chat.php may be used to send XSS visible inside Webbased Operator Client.

Anyone can run user defined function because of _call_userfunc().

str_replace() is used to sanitize file path but function output is not assigned to variable.

Using basic_settings() we can update every WordPress options, for example

$_REQUEST['title'] is not escaped.

$_REQUEST['widget'] is not escaped.