1) Open the file: include/library/phpfox/image/helper.class.php

Look for:
$sImage .= ' title="' . $aParams['title'] . '"';

Replace with:
$sImage .= ' title="' . htmlspecialchars($aParams['title']) . '"';

Next, look for:
$sImage .= ' alt="' . $aParams['title'] . '" ';

Replace with:
$sImage .= ' alt="' . htmlspecialchars($aParams['title']) . '" ';

2) Now open the file: module/captcha/include/component/ajax/ajax.class.php

Look for:
    public function reload()
    {
        $sUrl = Phpfox::getLib('url')->makeUrl('captcha.image', array('id' => md5(rand(100, 1000))));
        $this->call('$("#' . $this->get('sId') . '").attr("src", "' . $sUrl . '"); $("#' . $this->get('sInput') . '").val(""); $("#' . $this->get('sInput') . '").focus(); $("#js_captcha_process").html("");');
    }

Replace with:
    public function reload()
    {
        $sUrl = Phpfox::getLib('url')->makeUrl('captcha.image', array('id' => md5(rand(100, 1000))));
        $sId = htmlspecialchars($this->get('sId'));
        $sInput = htmlspecialchars($this->get('sInput'));
        $this->call('$("#' . $sId . '").attr("src", "' . $sUrl . '"); $("#' . $sInput . '").val(""); $("#' . $sInput . '").focus(); $("#js_captcha_process").html("");');
    }

3) For our last edit, open the file: module/share/include/component/ajax/ajax.class.php

Look for:
    public function popup()
    {
        Phpfox::getBlock('share.frame', array(
                'type' => $this->get('type'),
                'url' => $this->get('url'),
                'title' => $this->get('title')
            )
        );
    }

Replace with:
    public function popup()
    {
        Phpfox::getBlock('share.frame', array(
                'type' => htmlspecialchars($this->get('type')),
                'url' => $this->get('url'),
                'title' => htmlspecialchars($this->get('title'))
            )
        );
    }