In reply to Daniel James.

Which is why I said the labelling was unfortunate as I think most users now adays will update quicker if the changlog notes a security fix. On the one hand, you don't want to notify the world that an exploit exists. On the other, plenty of other people and organizations will or are already doing so, so the responsibility is on the plugin author to educate and inform their users.