I need to add that I remember reporting to ckosloff that the additional images were an issue when IH was updated for 1.3.9.. I also remember that he and had a bit of back and forth on the matter because he didn't think that what I was reporting was an issue.. That is part of the reason the large image popup got rolled back to an old version from a prior version of Zen Cart to begin with.. I had NO IDEA at the time that this would leave the image popups subject to XSS vulnerabilities.. I just knew that the popups and additional images were not working correctly, and I thought I found a solution..
Anyway.. mc12345678 again.. thanks for your tenacity, and patience..
