The mailchimp-for-wp plugin prior to 4.1.8 for WordPress has XSS via the return value of add_query_arg.
ibericode mailchimp