In reply to nick6352683.

Thanks for pointing that plugin out, Nick! I've reported it to the Plugins team, they'll work with the plugin author to get it fixed up. For future reference, you can report any plugins with security issues to plugins@wordpress.org.

You'll also be please to know that we've been experimenting with automated security scanning of themes and plugins, with some very promising results. It's not quite ready for public release (it still needs further development work, and we'd also like to give theme and plugin authors a chance to fix any issues), but we're at the stage where we're looking at how to ramp it up to scan the entire repo - it should hopefully be giving us useful protection in the near future.