It just keeps getting better and better.
https://www.searchenginejournal.com/nine-wordpress-plugins-expose-over-1-3-million-sites-to-exploits/439276/#close

"Vulnerabilities in Nine WordPress Plugins
While there were many more plugins found vulnerable, the nine most popular plugins affected well over 1.3 million websites. The vulnerabilities were rated
The following are on the list of nine vulnerable plugins:

Header Footer Code Manager 300,000+ installations
Ad Inserter – Ad Manager & AdSense Ads 200,000+ installations
Popup Builder WordPress plugin 200,000+ installations
Anti-Malware Security and Brute-Force Firewall 200,000+ installations
WP Content Copy Protection & No Right Click 100,000+ installations
Database Backup for WordPress 100,000+ installations
GiveWP – Donation Plugin and Fundraising Platform 100,000+ installations
Download Manager 100,000+ installations
Advanced Database Cleaner WordPress plugin 80,000+ installations"

Edit: Fixed title.