In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress includes/adamrob-parralax-shortcode.php allows XSS via the title text. (\parallax\ has a spelling change within the PHP filename.)