The echosign plugin prior to 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
smackcoders echo sign