plugin security flaw