The kento-post-view-counter plugin up to and including 2.8 for WordPress has XSS via kento_pvc_geo.
kentothemes kento-post-view-counter