CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
cmsmadesimple cms made simple 2.2.14