The Nexos theme up to and including 1.7 for WordPress allows side-map/?search_order= SQL Injection.
nexos project nexos