The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18609.json"