The matomo_integration (aka Matomo Integration) extension prior to 1.3.2 for TYPO3 allows XSS.
matomo integration