Facebook WordPress plug-ins found to have zero-day flaw