The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin prior to 1.0.7 for WordPress allows XSS with Internet Explorer.
lqd liquid_speech_balloon 1.0.5