The universal-analytics plugin prior to 1.3.1 for WordPress has XSS.
matchboxdesigngroup universal analytics