The event-notifier plugin prior to 1.2.1 for WordPress has XSS via the loading animation.
event notifier project event notifier