Newsletter plugin bugs let hackers inject backdoors on 300K sites