In reply to Chuck.

You should contact Cassandra Kirsch to sue WordPress.org if anyone has to be sued. WordPress.org is the supplier of plugins with vulns to the public. (John has stated that there is a plugin with 4000+ active installations on wp.org which he has sent messages about and Otto confirmed the message.)

Now long story short (and a real fix to the issue), wp.org should have a report a vuln or report a security issue button on each plugin which should send a private message that can be seen by both sender, reciever (plugin developer) and the moderators. If the plugin isn’t fixed within a given period of time then the plugin should be removed from the repository.

Anyone suggesting that John or Plugin Vulnerabilities should have contacted the plugin authors directly are wrong. How do you know that the given plugins didn’t have those malicious codes or vulns in them wasn’t on purpose or with bad intent? Moreover, the credit has to be given to the person or the team that have found the vuln or malicious code. The main reason I’m stating this way is that neither John nor others would be aware of the plugin if it wasn’t for wp.org repo. Now, people like John are reporting security issues and all those reports have to be “recorded” and credited on each instance.

Grow up fellas. Work to find solutions instead of non-stop continuous bickering.