Open edX platform prior to 2022-06-06 allows XSS via the "next" parameter in the logout URL.
edx open edx