≤ 3.8.7
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.