The bbp-move-topics plugin prior to 1.1.6 for WordPress has code injection.
bbpress move topics project bbpress move topics