In NCH Quorum v2.03 and previous versions, XSS exists via User Display Name (stored).
nchsoftware quorum