An issue exists in the Comments plugin prior to 1.5.6 for Craft CMS. There is stored XSS via a guest name.
verbb comments