< 3.7.5
3.7.5
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.