WordPress plugin installed on 1M+ sites logged plaintext passwords

I wonder how many security flaws were in Wordpress core all these years or how many were from plugins with garbage code.

TLDR: The plugin is ironically a security plugin. All-In-One Security.