The libconnect extension prior to 7.0.8 and 8.x prior to 8.1.0 for TYPO3 allows XSS.
libconnect project libconnect