1 of 3

XSS vulnerability on chat

I recently baceame the security administrator of this website "http://www.radio-anime.net/", I'm not a security master, but i took it as a chance to actually understand how security works nowadays, however, this website has a chat, and I was wondering "Is this chat vulnerable to XSS?" so I tried to see which characters are escaped, (because since the chat is a prefab nobody in there can tell me how it works, and i foun that the <> are escaped, however I can use a the command [img]www.anywbsite.com/image.jpg[/img],and it will show a preview of the image on the chat, so this way it seems pretty safe, the proble is that i can put in there any url at all (even urls that doesnt exist, as long as it has a "www" and a ".com" at the end it will run the command, so i was wondering, is there any way i can malform a url into a script? or something like that? thanks! as you can see, the script runs but shows no preview, because there is no image(the input was "[img]www.nonexistingurl.com[/img]"