Live Helper Chat prior to 3.44v allows stored XSS in chat messages with an operator via BBCode.
livehelperchat live helper chat