The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9425.json"