The users-ultra plugin prior to 1.5.63 for WordPress has XSS via the p_name parameter.
usersultra users ultra membership