Malicious campaign exploits high-severity XSS flaws in three WordPress plugins to backdoor websites