The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.