The flickr-justified-gallery plugin prior to 3.4.0 for WordPress has XSS.
flickr justified gallery project flickr justified gallery