The LearnDash LMS plugin prior to 3.1.2 for WordPress allows XSS via the ld-profile search field.
learndash learndash