Somewhere in between. Gravity Forms is a very popular premium WordPress plugin. I maintain a handful of WordPress sites (wouldn't have been my choice of platf

Somewhere in between. Gravity Forms is a very popular premium WordPress plugin. I maintain a handful of WordPress sites (wouldn't have been my choice of platform but whatever) and the design and functionality of Gravity Forms is better than most (aside from it being CPU-hungry). It doesn't generally give me trouble and as a developer I've been happy with how Rocket Genius have interacted with me when I've filed trouble tickets. A pretty substantial number of small and mid-tier orgs have Gravity Forms installed. I don't know the numbers — the wordpress.org popularity stats mainly reflect installation of free plugins not premium — but there should be a lot of sites handling a lot of traffic. EDIT: That's the number of sites which could have been affected. Fortunately only a small number of sites actually got the compromised package because it didn't enter the main automatic distribution chain.