The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoption[selectorwplistpages][show_selector] parameter to wp-admin/options.php.