controller/controller-comments.php in WP GDPR plugin up to and including 2.1.1 has unauthenticated stored XSS.
appsaloon wp-gdpr 2.1.1