MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.
modx modx revolution 2.6.5