Images uploaded to the "files" directory of xcart aren't being displayed, and when bringing up the image directly the server gives a 403 "forbidden" error.
By default, x-cart includes an .htaccess in the files directory that instructs the server to "deny from all" - which is useful if you don't want anyone to access those files. Assuming you do want to display the images in x-cart, delete or rename the .htaccess file via cpanel file manager, and the images should then display correctly. If the images still aren't displaying, try disabling your hotlink protection temporarily to see if the problem disappears. If it does, adjust your hotlink protection settings to allow access from all needed urls.