yellow pencil plugin vulnerability