Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

<?php

class Text_Wiki_Render_Plain extends Text_Wiki_Render {
    
    function pre()
    {
        return;
    }
    
    function post()
    {
        return;
    }
    
}
?>