The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoption[posttype][page] parameter to wp-admin/options.php.