Thirty WordPress plugins are actively being exploited by a pair of trojans that redirect traffic to malware infected sites.