The iThemes Security plugin prior to 6.9.1 for WordPress does not properly perform data escaping for the logs page.
ithemes security