MyBB 1.6.1 Released

[ZiNgA BuRgA]

I believe it's an XSS fix, which isn't *too* big of a hole TBH.  It's been public knowledge for a while anyway: http://dev.mybb.com/issues/1331
Worst case scenario for an XSS attack is that someone gets an admin account, however, they'll unlikely be able to get AdminCP access.

Considering that so many custom MyCodes essentially give XSS vulnerabilities, and no-one seems to notice until I point it out, I really doubt you're at much risk of an XSS based attack.
Nevertheless, it's possible I guess >_>

For people who mod files, just do a diff of your modified files against a stock 1.6.0 (WinMerge is handy) to find what you've modified.  You can even try creating a patch file and applying it to 1.6.1, though it may not work.