In reply to Donna Cavalier.

+1 to this approach. This way the site owner gets info about the security issue of the closed plugin, but the "bad guys" would not know anything.