vulnerable plugins