The ultimate-member plugin prior to 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
ultimatemember ultimate member