The users-ultra plugin prior to 1.5.64 for WordPress has SQL Injection via an ajax action.
usersultra users ultra membership