
A popular plugin for the WordPress website builder with more than a million users was caught storing user passwords in plaintext, available for website admins to read whenever they pleased.
A report on Ars Technica found the plugin in question, called All-In-One-Security (AIOS), was installed on at least a million websites.