The awesome-support plugin prior to 3.1.7 for WordPress has XSS via custom information messages.
getawesomesupport awesome support