WordPress

This can lead to remote code execution and information leak. Attackers can also inject malicious code into /diagnostic/editclient.php?id=; /diagnostic/editclient.php?id=

A successful attack can cause the injection of malicious code into a web server’s software or cause denial-of-service conditions for legitimate users. IPAM administrators

If you use the unfiltered_html setting and are logged in as a user with high privileges, an attacker could inject malicious code into comments

or outside of WordPress. A malicious user could rename a plugin file, for example, rename wp-config.php to wp-config-remote.php and access a different configuration.