The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
realbigplugins client dash 2.1.4