The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.

Link: http://www.security-database.com/detail.php?alert=CVE-2018-18919