< 2.4
2.4
The megamenu plugin before 2.4 for WordPress has XSS.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.