The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
No related bugs.