Wordpress from xss to shell upload