What I understand with reflected xss is:
It is from allowing html submits from a user.
HTML submits can be allowed but it has never been endorsed to allow the general public to use.
This forum software allows the admin to not allow anyone to post using HTML except for the admin if desired.
