In reply to Donna Cavalier.

I don't know how to reply to Central Geek - seems like we can't reply that far in the comment chain? So I'm replying here - sorry.

Absolutely disagree with you, Central Geek. Vehemently and with every fiber of my being. Of course it's the plugin developer's responsibility to fix it, but the Directory removed it - so the directory should notify the plugin users. I'm sitting here learning about Contact Form DB for the first time - and I have it installed on our live site! If you remove the plugin for security reasons - don't you think the people with it installed on a live site should be notified?? We're the ones now using an unsafe plugin on our site with absolutely zero knowledge of the problem. My Contact Form DB is sitting in my site's backend, happily chugging away, with zero notice of any security issues or risks. And there's no way for the developer to contact me to let me know, because the plugin was pulled.

This isn't a complicated concept. Even an automated system would fix it - but the only ones with the ability to notify are the Directory folks, and the users need to be notified. There's only one option at that point. The Directory must notify the users.