Microsoft's Internet Explorer 7 (IE7) is vulnerable to cross-site scripting that could allow attackers to spoof a trusted site to launch a phishing attack.