Could XSS lead us to the Local File Include or Remote File Include? I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.
Furthermore the upload function might not even be intended for plugins but just for images. It might not properly validate the upload, and put the uploaded files into a directory in which .php files are executed, for example.
This might either be a bug because the developers were not aware of the risks, or just a dangerous omission based on the assumptions that only trustworthy people upload files. That's were the XSS vulnerability comes into play.