Please don't make excuses for it.

I've had to deal with the multi-day aftermath of an XSS worm twice. That's when you realise that it's as bad as it is. After that it was "get fucked" and move to phpbb which while is not a stellar product it seems to be put together with a modicum of common sense and has a responsive community and support.