decidim-meetings versions 0.28.0 up to but not including 0.28.3 contain a cross-site scripting (XSS) vulnerability in the meeting embeds feature used for online or hybrid meetings. This vulnerability can be triggered through a malformed URL, potentially allowing an attacker to execute malicious scripts in the context of the affected application. No official patch is currently available. A recommended workaround is to disable the creation of meetings by participants in the meeting component to mitigate the risk.