The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
https://wpvulndb.com/vulnerabilities/9004
https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md