Three popular plugins served malicious JavaScript through a compromised CDN.