The Auth0 wp-auth0 plugin 3.11.x prior to 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
auth0 login by auth0