Live Helper Chat prior to 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
livehelperchat live helper chat