Do you access a WordPress installation on a web server without HTTPS? If so, your passwords are sent in plaintext every time you login, register for accounts, add new users through the admin interface, and change user passwords.

Fortunately, there is a solution (actually, one of many) for WordPress fans to improve the sending of passwords over HTTP. The plugin is called Semisecure Login Reimagined.

Read the HOWTO here: http://pdub.net/2011/12/05/secure-wordpress-login-without-https/