Well, why isn't their an industrial strength validator for plugins??? I have had many of my WP sites wrecked over and over by those exploits. The only way I can run WP now is with no plugins whatsoever. It's boring but it's the only way I can keep out the pirates. I use 1-and-1.com so there are no "server configurations" I can monkey with. I only get to choose my PHP level and that's all folks.