I installed the security patch SUPEE 7405 by shell. The output said that the patch was successfully installed:
Checking if patch can be applied/reverted successfully... Patch was applied/reverted successfully.
grep '|' app/etc/applied.patches.list shows me that the patch is installed:
2016-01-26 12:42:44 UTC | SUPEE-7405-CE-1-9-2-2 | CE_220.127.116.11 | v1 |
I also checked some PHP files that had to be patched and they were.
The cache were cleared after installing.
The problem is that the XSS attack is still possible.
magereport.com said that the patch is not installed.