The users-ultra plugin prior to 1.5.63 for WordPress has XSS via the p_desc parameter.
usersultra users ultra membership