The Auberge theme prior to 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
webmandesign auberge theme