Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products possibly including (1) LiveForum (2) LiveQ&A (3) LiveChat and (4) LiveFocusGroup allow remote attackers to inject arbitrary web script or HTML via the q parameter in (a) search.jsp (b) findclub!execute.jspa and (c) search!execute.jspa.