XSS exists in Easy WP SMTP (prior to 1.2.5), a WordPress Plugin, via the e-mail subject or body.
wp-ecommerce easy wp smtp