plugin security flaws