The history-collection plugin up to and including 1.1.1 for WordPress has directory traversal via the download.php var parameter.
ionadas history collection