The ke_search (aka Faceted Search) extension up to and including 2.8.2, and 3.x up to and including 3.1.3, for TYPO3 allows XSS.
faceted search project faceted search