For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).

For another, an integrated comment system that stores credentials for anonymous Internet users in the same data structure as the one used for site administrators.