In NCH Quorum v2.03 and previous versions, XSS exists via /conference?id= (reflected).
nchsoftware quorum