This is a residual post from my investigation of CMS and message boards a few weeks ago.
Like some of the other software that I looked at during those days xoops also insists on gathering the password in a textfield instead of a password field. The admin password on the other hand is gathered correctly, so one can assume that they know how to do it properly but chose not to.
The installer is pretty much dumb proof which is not always desirable. Unforunately the administration interface is the complete opposite and there isn't even a help section. The menu is very confusing. The text on those buttons are readble only at 800x600