That's actually not quite what's happening. The vulnerability in vBSEO does not allow users to upload files. By all indications, it's a relatively normal persi

That's actually not quite what's happening. The vulnerability in vBSEO does not allow users to upload files. By all indications, it's a relatively normal persistent XSS vulnerability. However, because of the nature of XSS and the functionality built into vBulletin, it's possible to add executable code to the filesystem. It's always good to remind people that building functionality like that has unintended consequences.