Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.
function init() {
tinyMCEPopup.resizeToInnerSize();
}
function insertEmotion(file_name, title) {
title = tinyMCE.getLang(title);
if (title == null)
title = "";
// XML encode
title = title.replace(/&/g, '&');
title = title.replace(/\"/g, '"');
title = title.replace(/</g, '<');
title = title.replace(/>/g, '>');
var html = '<img src="' + tinyMCE.baseURL + "/plugins/emotions/images/" + file_name + '" mce_src="' + tinyMCE.baseURL + "/plugins/emotions/images/" + file_name + '" border="0" alt="' + title + '" title="' + title + '" />';
tinyMCE.execCommand('mceInsertContent', false, html);
tinyMCEPopup.close();
}