The instalinker plugin prior to 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
elfsight instalinker