I see that this is a big problem, not only related to the Wordpress but any other software where third-party add-ons, plugins are loosing support from original author.
But let's focus on Wordpress... According to WordFence there is:
17,383 of those plugins have not been updated in the past 2 years.
3,990 plugins have not been updated since 2010 which is over 7 years ago.
According to Isabel’s post there are several plugins that have a large install base that haven’t been updated for some time:
“Exec-PHP plugin by Sören Weber has over 100,000 active installs despite that it has not been updated since June of 2009. Category Order by Wessley Roche has over 90,000 active installs even though it was last updated in May of 2008. Ultimate Google Analytics by Wilfred van der Deijl has over 80,000 installs even though it was last updated more than nine years ago.”
Beside bad coding which many times lead to newly discovered vulnerabilities, and not only that, many authors are leaving their project without any support, some of them are responding, the other one are completely gone.
There was also a problem with expired domain, here is an article: Expired Domain Leads to WordPress Plugin Redirects
So what can users do in order to prevent this problem, is there any option which will alert users if add-on is vulnerable but there is no update for it?