Security problems like this are so common in 3rd party extensions / plugins / add-ons. While the most widely used open source ones tend to have less bugs many of the less popular ones are full of problems. Take a look at WordPress plugins to see what I mean.