The memphis-documents-library plugin prior to 3.0 for WordPress has XSS via $_REQUEST.
memphis documents library project memphis documents library