The posts-in-page plugin prior to 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
ivycat posts in page