The google-language-translator plugin prior to 5.0.06 for WordPress has XSS.
gtranslate google language translator