The ultimate-member plugin prior to 1.3.18 for WordPress has XSS via text input.
ultimatemember ultimate member