Around Lines 126 to 151...
if ( empty($_REQUEST['users']) )
$userids = array(intval($_REQUEST['user']));
else
$userids = $_REQUEST['users'];
...
foreach ( (array) $userids as $id ) {
$user = new WP_User($id);
if ( $id == $current_user->ID ) {
echo "<li>" . sprintf(__('ID #%1s: %2s <strong>The current user will not be deleted.</strong>'), $id, $user->user_login) . "</li>\n";
} else {
echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "</li>\n";
$go_delete = true;
}
}
As we can see on the present code, $id came from either users or user http request variable, user is well casted to integer but users is not so it could lead to and a XSS attack.
However in order to work, the attacker needs at least to know a valid nonce, which is kinda hard so it turns to be a harmless (or poor) XSS.
