This report isn't one bit surprising to me . It seems that almost every WP plugin I've read is vulnerable. This needs to be fixed, so my company started a service where we will scan a plugin or theme for free and try to get the fixed code into the wordpres repo.

I read your daily plugin posts and sometimes I decide to read the code of the plugin and they usually are vulnerable to being hacked.