The events-manager plugin prior to 5.5.7.1 for WordPress has DOM XSS.
wp-events-plugin events manager