The wp-support-plus-responsive-ticket-system plugin prior to 4.1 for WordPress has JavaScript injection.
wpsupportplus wp support plus responsive ticket system