Critical bugs in WordPress plugins put over 300,000 websites at risk