The google-analyticator plugin prior to 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
sumo google analyticator