The insert-pages plugin prior to 3.2.4 for WordPress has directory traversal via custom template paths.
insert pages project insert pages