It ‘was released a security patch to close a serious vulnerability in the Private Message module in Xoops Protector and 2.3.3.
Not yet confirmed the presence of this bug in the PM module, you should apply the patch ( downloadable here ) just to the Protector module, since in some cases has compatibility issues.
It is recommended to patch the module as soon as possible to the holders of Xoops 2.3.3.