Carl has his own thread for the commenting module here:
<!-- m --><a class="postlink" href="
www.cmsmarket.com/forum/index.php?f=43&rb_v=viewforum">
www.cmsmarket.com/forum/index.ph ... =viewforum
We've been notified of the cross-scripting problem with JFBInvite, but so far, have only been able to determine that this is an issue with Facebook's implementation. We'll keep everyone posted, but there is no new status on this yet as we are calling their functions and that's required.