In reply to Guido.

This is a perfect example. It had a vulnerability. You are therefore probably running the insecure version. What you don't know is that repo pulled it, one of the core people got into some kind of disagreement with the plugin author, and the author moved the plugin to github. Now, even if the author fixes the security, you'll not only never know about the fix, you'll never know there was an issue to begin with. Your WordPress admin will keep making it look as though your plugin is perfectly up to date and fine. But core knows it isn't. They just haven't bothered to figure out a way to let you and the other thousands of users know. And please, none of the "this is free so get over it" or "this is hard" stuff. Yeah, got it. Free. Volunteers. Yep. Now, can we get back to the problem? If you're interested in seeing the thread I stumbled on about the db plugin, it's here: https://wordpress.org/support/topic/plugin-is-missing-on-the-wordpress-org-directory/