Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

// UK lang variables

tinyMCE.addToLang('',{
insert_advhr_desc : 'Horizontale rule',
insert_advhr_width : 'Width',
insert_advhr_size : 'Height',
insert_advhr_noshade : 'No shadow'
});