Dozens of WordPress plug-ins were allegedly hijacked to push malware after they were sold to a new corporate owner.