WP Campus regularly posts a list of known vulnerable plugins on their blog at: https://wpcampus.org/category/security/
I’ve added this as an RSS feed in the sidebar of this site.
Keeping track of these can be tricky, so this is a good place to make sure the plugins you are using do not have known issues. As always, make sure to keep your systems patched.