Please report a vulnerability in Pluma privately through GitHub private vulnerability reporting, not in a public issue or pull request. Say which version you ran, on which platform, and how to reproduce the problem.

Nodalia maintains Pluma and handles every report. Only the latest release receives security fixes.