Design/Logic Flaw

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header...