The ninja-forms plugin prior to 3.4.24.2 for WordPress allows CSRF with resultant XSS.
ninjaforms ninja forms