In NCH Quorum v2.03 and previous versions, XSS exists via Conference Description (stored).
nchsoftware quorum