The Recent Threads plugin prior to 1.1 for MyBB allows XSS via a thread subject.
recent threads project recent threads