admin/themes/default/items/tag-form.php in Omeka prior to 2.6.1 allows XSS by adding or editing a tag.
omeka omeka