Keeping plaintext passwords anywhere in any capacity is usually a bad idea. Sessions are safe as such, but only as safe as the rest of your server environment. Administrators or other users both legitimate and nefarious may have access to data stored on it. You never want to handle the secrets of your customers if you can avoid it; that also means you want to avoid seeing the user’s password under any circumstances and you should build your code in a way that the plaintext password is as short lived as technically possible.
If you need to use the password for something during a session, you should architect your app so it never uses the plaintext password, but use a key derivation function to derive a key from the password which you then use for your sensitive tasks. This way there’s a lot less chance to expose the user’s password. Remember, the only security the user has is the secrecy of his password that only he is supposed to know.