No, the only place anyone can upload anything is through the backend via TinyMCE, and I banned words like <script> and php? etc in my jot comments badwords chunk. There are only two people who have any access to two of my sites, and they have very limited privileges. The installation of ModX in the simonwyndham directory was not even live, so I do not know how they knew it was there.
