Helpy version 2.8.0 contains a stored cross-site scripting (XSS) vulnerability in the post author display logic. Registered users can inject arbitrary HTML into their account name, which is then rendered unescaped in public forum threads, the admin ticket view, and HTML notification emails. This could lead to partial compromise of confidentiality and integrity but does not affect availability.