The rimons-twitter-widget plugin prior to 1.3 for WordPress has XSS.
rimons twitter widget project rimons twitter widget