1
I just noticed on a XOOPS site that i frequent that it's possible to use the style="" attribute to do just about anything when HTML is enabled. There's nothing dangerous can be done AFAIK, but I managed to get an image to position itself over all of the content on the page making everything else unclickable.
<img src="foo" style="position:absolute;top:0px;left:0px;width:100%;height:100%;" alt="bar" />