The colorway theme prior to 3.4.2 for WordPress has XSS via the contactName parameter.
inkthemes colorway