96% of WordPress vulnerabilities come from plugins.
So says the annual report published by the security organization Patchstack, one of the central bodies in the WordPress community.
True, we have published quite a few articles about this, we have urged, emphasized and repeated ourselves again and again – but seeing it appear in Patchstack's annual summary report deserves separate attention. Patchstack, which is well known in the global WordPress community, researches, monitors and tracks the various vulnerabilities. Its reports are based on in-depth work and a thorough analysis of huge amounts of data.
We will review, briefly, some of the findings.
Nearly 8,000 new vulnerabilities – a sharp increase compared to the previous year
In 2024, 7966 new security vulnerabilities were discovered in the WordPress ecosystem – an increase of about 34% compared to the previous year.
Nearly half of the vulnerabilities allow an attacker to perform an action on the site – without authenticating
About 43% of all those vulnerabilities allow an attacker to send a message remotely and make the site perform an action, without authentication, with no need for a username or password.
Just because a plugin is popular – it does not mean it is safe
A high number of installs is no guarantee of quality or maintenance – even plugins with hundreds of thousands or even millions installs had vulnerabilities severe.
Another worrying phenomenon that the report points to is that even when security researchers contact plugin developers and give them an opportunity to fix the weakness before it is made public, more than half of them do not respond or are in no hurry to publish an update on time.
So what do we do?
Using well-known and maintained plugins that receive regular updates; removing plugins that are unused or inactive – even code that seems "dormant" may contain weaknesses; keeping up with updates; using protection systems such as a WAF; and of course tracking weaknesses and vulnerabilities through reliable sources – the information is available in many places.
And what about the hosting companies?
This is not part of the report, but it is worth noting that some of the leading WordPress hosting companies also help in these areas. Kinsta and WP Engine, for example, offer their customers advanced security solutions as part of dedicated plans that include various mechanisms and processes, usually within a premium service. uPress offers dedicated security scans and real-time alerts, even in the basic package, including recommendations from WordPress experts, automatic updates for various components, and additional layers of protection.
In summary
The extensive WordPress community is responsible for a huge range of plugins and features for every need. This is one of the reasons the platform is so popular and powerful. But this comes at a price.
Therefore, right before you rush to install a plugin, take a breath and devote at least a few minutes to checking, and even ask your favorite AI model to help you trace the plugin's reliability, its history, and the way it is maintained. If you reach the conclusion that the plugin is not safe enough – there is no way you will not find a safer alternative plugin.
And of course, and no less important – carry out maintenance, monitoring and updates in a truly ongoing way. For plugins, for themes and in fact for all the components of the site. There is no substitute for this.
It is very advisable to stay on the safe side of the statistics.
*For those interested in going deeper, it is recommended to go through the report itself:
https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/
