Report vulnerabilities privately using GitHub private vulnerability reporting. Do not publish unpatched vulnerability details in public issues. For reproducible non-security bugs use GitHub Issues.
Provide plugin, WordPress and PHP versions, reproduction steps and impact. Omit credentials and personal data.