The easy-property-listings plugin prior to 3.4 for WordPress has XSS.
realestateconnected easy property listings