It's obvious from looking at my server logs that there are plenty of plugins with vulnerabilities, as evidenced by the constant 404 errors from plugin probing. I have put measures in place to quickly ban IP addresses probing for plugins I don't have installed, which helps but is not a total solution.

I wonder if there is something we could do as a community where we voluntarily offer stats of what plugins get probed so that users and plugin creators can get notified when probing for a plugin goes over some threshold? Yes, the horse is already out of the barn at that point, but when the bad guys discover and begin to exploit vulnerabilities this could provide a warning system.