Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

/* This is the CSS file for the noneditable elements plugin */

.mceEditable {
	/*border: 1px dotted #0000cc;*/
}

.mceNonEditable {
	/*border: 1px dotted #cc0000;*/
}