$_POST[ 'id' ] is not escaped. populate_download_edit_form() is accessible for every registered user.

parse_str() function is used without second param so variables are set in current scope.

If user has at least one not dismissed notice, we have reflected XSS.

Every registered user can change every account because `Request

$_GET['order'] is not escaped.

$item_id inside process_category_order() is not properly escaped. Then it's used in UPDATE statement.

$_POST['thumbtext'] and $_POST['linkbutton'] are not escaped inside huge_it_video_gallery_ajax().

$_GET['loginerror'] is not escaped.