"The mentioned issue, ie passing script via the form, will only affect the USER who is doing it." you probably mean the person who is the target of such an attack, right?! "It has no effect on the AZbb, the server or the forum" That is what XSS is about,it effects the client.