The master public key is like a seed that only allows you to figure out the Bitcoin addresses in your wallet, but not the private keys. Those wordpress plugins you saw use the MPK to get deposit addresses.
A bad guy with your MPK can only figure out your Bitcoin addresses, but not your private keys so they cannot steal your Bitcoins.
However, if the bad guy has your MPK and one of your private keys, he can then calculate all the other private keys and steal your Bitcoins. This is the reason you should never export private keys from electrum.
Oh , I see now , everything looks clear now to me .
Thanks for the explanation mate , really appreciate it . It was just a quick question so going to lock the thread now
thanks again dude