haazee wrote

For example a malware can do anything as admin on your router while your browser is running. (see XSS as a sample!)

If you use a browser (i.e. Microsoft Internet Explorer Version 6) which does not encode < and > in URLs and therefore is vulnerable to DOM-based XSS attacks, you have a tremendous security hole anyway. In this case I would not be concerned about malware breaking into my router, but I would be concerned at first to use such a system full of holes like Swiss cheese to visit any shopping site or even bank accounts, where they can do real harm.

But if you really did find a security hole for reflective or persistent XSS attacks in TP-Link's web UI, proof it before claiming that it could be subject to XSS attacks. Which web page of the TL-WR740's web UI does output data previously entered by the user without checking for critical input? I couldn't find a guestbook or a forum in TL-WR740's web UI and it also does not have a search form or anything which could be used to enter critical data in the web UI being displayed without plausibility checks due to bad programming.

The fact that you stay logged in somewhere while surfing other (malicious) web sites is in no way the cause for XSS attacks as your claim suggests, except that it indeed may pose a massive risk for such if you use software which is broken by design such as IE 6 or older Windows (before Vista) versions.