Dozens of WordPress plugins were allegedly hijacked to push malware after they were sold to a new corporate owner.