Patchstack 2026 Report: 11,334 WordPress Vulnerabilities in 2025, 91% in Plugins
The 2026 State of WordPress Security report by Patchstack revealed a significant rise in vulnerabilities, totaling 11,334 in 2025, marking a 42% increase. Of these, 91% were attributed to plugins, while only 6 were found in the WordPress core. The average time from vulnerability disclosure to exploitation was just 5 hours, with 46% remaining unpatched at the time of disclosure. Traditional security measures managed to thwart only 12% of attacks specific to WordPress. The database currently lists over 53,000 vulnerabilities. A report from January 2026 identified 333 vulnerabilities, averaging about 48 per day. In 2025, highly exploitable vulnerabilities surged by 113%, with Broken Access Control being the most frequently targeted. In 2024, 43% required no authentication, and cross-site scripting accounted for 47.7% of issues. Additionally, Veracode's 2026 analysis indicated that AI introduced security flaws in 44% of coding tasks.
Key facts
- 11,334 WordPress vulnerabilities were discovered in 2025, up 42% year over year (Patchstack)
- 91% of vulnerabilities are in plugins; WordPress core had only 6
- Median time to mass exploitation was 5 hours
- 46% of vulnerabilities were unpatched at disclosure
- Traditional defences blocked only 12% of WordPress-specific attacks in Patchstack's 2025 pentests
- Highly exploitable vulnerabilities increased 113% year over year in 2025
- Broken Access Control was the most exploited vulnerability type in 2025
- About 2.6% of WordPress sites run version 4.x or older; only ~62% run PHP 8.2 or newer
Entities
Institutions
- Patchstack
- Liquid Web
- Veracode
- WordPress.org
- W3Techs