CleanTalk WordPress plugin vulnerability affecting up to 200,000 sites could lead to remote code execution by unauthenticated attackers.
WPvivid Backup & Migration plugin allows for arbitrary file upload which can lead to remote code execution.