There's a new and already widespread exploit in WSN. It's a bit clever, but
basically it involves uploading an avatar which contains text and then using
the custom templates system to load and execute that avatar's text as PHP to
download a shell with which they can take full control. All they *appear* to
be doing with that full control is editing wrapper templates to insert
javascript just below the body tag.

This javascript infects your visitors who use certain vulnerable web
browsers, of which Internet Explorer 6 is confirmed to be one.

To de-infect, please follow these steps for each WSN installation you have:
1) Remove the above javascript from your wrapper template.
2) Check for a file named threaduser.php (in the base WSN directory) and
delete it. This isn't a WSN file, it's created by the hacker.
3) Upgrade to the latest release.

You may want to run a virus scan on your computer in case you've used a
vulnerable browser.

To prevent this from happening again, custom templates are no longer allowed
to specify directory paths and avatar file names are no longer visible. As a
preemptive precaution, since so many exploits for so many scripts rely on
variations of the tactic, URLs can no longer be embedded within query
strings.