Hi ch3nyong,

the module team has been discussing long time about this weakness. This issue has been taken into account during the development of version 03.05.00, and script injection has been disabled along with most HTML tags. Version 03.05.00 has already been submitted to the release tracker, so you will not have to wait long to see this enhancement in action. 

In the meanwhile I suggest you to use moderation even on registered users to avoid malicious injections. I also remind you that you can easily check which registered user added the malicious script and eventually block him.

Best regards,
Dario Rossa

Hi ch3nyong,

you're right, this weakness to malicious script injection should had been taken into account earlier. However the next version will include a powerful filter to avoid any issues. To fix it in the current version you will need to open the actual module project, modify it and recompile. A good place to put the filter would be just before the comment is added to the database. I would suggest you to filter out also the HTML tags other than <img>, <b>, <u>, etc. because I experimented that also these ones can break up the page layout.

Best regards,
Dario Rossa