More than 11,000 new vulnerabilities were found in the WordPress ecosystem in 2025, nine in ten of them in plugins, and the worst were being exploited within hours. A site nobody looks after is a liability.
A website is not finished when it launches. It is software, built from parts written by other people, and those parts keep changing whether or not anyone is watching.
The numbers from 2025
Patchstack, which tracks vulnerabilities in the widely used WordPress platform, recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42 percent increase on 2024. Ninety-one percent were in plugins and 9 percent in themes. Only six were reported in WordPress itself, and those were low priority.
Of the new vulnerabilities, 36 percent were serious enough to need active protection, and 46 percent had not been fixed by the time they were made public. For the most heavily exploited, the median time to mass exploitation was five hours. Broken access control, where a site fails to check who is allowed to do what, was the kind attackers exploited most.
Where the risk really lives
The core software is rarely the problem. The risk sits in the long tail of add-ons: the contact form plugin installed years ago, the theme from a developer who has moved on, the integration nobody remembers adding. Each is a door, and attackers' scanners check them all automatically.
What maintenance means in practice
- Keep an inventory of every plugin, theme and integration, and remove anything unused.
- Apply security updates within days, not at the next redesign.
- Prefer a few well-maintained components to many small ones.
- Watch for vulnerabilities in what you run, so fixes land before the scanners arrive.
- Keep tested backups you can restore quickly.
None of this is unique to WordPress; any platform built from third-party parts carries the same risk. The difference between a safe site and a compromised one is usually not the technology. It is whether someone is responsible for it.
Sources
Written by Aevion Labs from the sources above. Figures are as reported by each source on the dates shown.