@Thomas Scholz - If your comment were a nail, you just hit it on the head! The only way to solve all (or very close to all) vulnerabilities with plugins (themes too) is to have a strict review process. Who's going to foot the bill for that? That's why Github, or any setup like it, is a better way to maintain repositories of code and have move users and developers, interact and contribute to finding and fixing bugs including vulnerabilities. Trac makes your eyes bleed. WP.org repo needs a format similar to Github or BitBucket.