The formcraft3 plugin prior to 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
ncrafts formcraft