The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
CWE-78, NVD-CWE-noinfo