Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

<?php
class Text_Wiki_Render_Plain_Tighten extends Text_Wiki_Render {
    
    
    function token()
    {
        return '';
    }
}
?>