In Wordfence’s monthly report about attacks on WordPress websites, they list the top 25 plugins that received the most focus in January 2017. In order of the number of MOST attacks received, they are:
The report goes on to say:
The WP-Mobile-Detector plugin saw the biggest gain in the number of attacks, jumping 25 points in our rankings to position 12. The plugin has been removed from the WordPress plugin repository, probably because a vulnerability was not fixed by the author, and the last review was posted over 7 months ago.
Read the full report here.