The "CP Contact Form with PayPal" plugin prior to 1.2.98 for WordPress has XSS in CSS edition.
codepeople cp contact form with paypal