The WebDorado "Form Maker by WD" plugin prior to 1.12.24 for WordPress allows CSV injection.
web-dorado form maker