The ad-inserter plugin prior to 2.4.22 for WordPress has remote code execution.
ad inserter project ad inserter