The volume keeps climbing
| Item | Value |
|---|---|
| 2024 | 7,966 |
| 2025 | 11,334 |
WordPress core itself is in good shape. It had only 6 vulnerabilities in 2025, all low priority. The problem is the ecosystem around it: 91% of new flaws were in plugins and 9% in themes.
Fixes are arriving later
| Item | 2024 | 2025 |
|---|---|---|
| No patch available | 33% | 46% |
When a vulnerability is published with no fix, every site using that plugin is exposed until the developer responds, and some never do. Of the 2025 flaws, 1,966 (17%) were rated likely to be exploited at mass scale, a 113% increase on the previous year.
What attackers target
Broken access control was the most exploited category. Among the 10 most-targeted vulnerabilities were privilege escalation, authorisation bypass, unauthenticated stored XSS and arbitrary file upload. These are the bugs that let an anonymous visitor become an admin.
| Item | Value |
|---|---|
| Of all websites | 40.1% |
| Of sites with a known CMS | 58.6% |
How to secure a WordPress site
- Keep plugins to a minimum. Every plugin you remove is one less thing to patch.
- Delete plugins that haven't been updated in over a year.
- Turn on automatic updates for minor releases and security fixes.
- Add virtual patching or a web application firewall to cover the gap before fixes ship.
- Give users the lowest role they need, and enforce two-factor login for admins.
- Keep daily off-site backups and test a restore at least once a quarter.
Frequently asked questions
How many WordPress vulnerabilities were found in 2025?
Patchstack reported 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% from 7,966 in 2024.
Is WordPress core secure?
Largely yes. WordPress core had only 6 vulnerabilities in 2025, all low priority. 91% of vulnerabilities were in plugins and 9% in themes.
How do I secure a WordPress website?
Use as few plugins as possible, delete abandoned ones, enable automatic security updates, add a web application firewall or virtual patching, enforce two-factor login for admins and keep tested off-site backups.
