Using flv_stream.php file from vendor directory we can download any file.

$_GET['name'] is not escaped and then displayed inside pop_editor_view.

Items from $_REQUEST['settings'] are not escaped.

$_GET['sm'] is not escaped.

PHP filter_input() function with FILTER_VALIDATE_URL flag is used to validate url inside savefaq functionality.

$_POST[ 'id' ] is not escaped. populate_download_edit_form() is accessible for every registered user.

parse_str() function is used without second param so variables are set in current scope.

If user has at least one not dismissed notice, we have reflected XSS.