just did a search on the use of $_POST in moodle and was surprised at the number of occurances.... spotted one in choice that should be fixed as it's used without being cleaned!
in choice/report.php
$attemptids = isset($_POST['attemptid']) ? $_POST['attemptid'] : array(); //get array of repsonses to delete.