The wp-ultimate-recipe plugin prior to 3.12.7 for WordPress has stored XSS.
bootstrapped wp ultimate recipe