The WP Statistics plugin up to and including 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
wp-statistics wp statistics