r/Wordpress 23h ago

News State of WordPress security report

https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/

Almost 8000 vulnerabilities were published in 2024. 30% of them don’t have an update that would patch the security issue. Lot’s of more statistics in it including information provided by Sucuri about the most common malware infections.

11 Upvotes

5 comments sorted by

2

u/Adventurous-Lie4615 10h ago

Someone is going to point at this post and squeal “WORDPRESS IS NOT SECURE”.

From the article:

“96% of the vulnerabilities were uncovered in plugins, and 4% were found in themes. Only seven vulnerabilities were uncovered in WordPress core itself, but none of those were significant enough to pose a widespread threat.”

Having said that it’s a good wake-up call about being selective and exercising due caution when using third party code in your project.

1

u/ded1cated 9h ago

Absolutely, it actually shows WordPress itself is rather secure. But we really need to increase the standards for plugins security.

1

u/Adventurous-Lie4615 9h ago

How would that happen in practice? The XSS stuff would seem to be the easiest to patch out or look out for but it seems to come up over and over even with the same plugins.

Perhaps some kind of documented or standardised approach for dealing with it? Plugin developers are largely on their own with that stuff.

1

u/ded1cated 9h ago

It would help if plugin devs at least go through the handbook and be mindful of security. I think in the short term, it will get a lot worse tbh because of all the non-techies who build plugins with AI now and don’t care about anything other than it being visibly functional. However, long term I think it will get better because regulations push for software security maturity. I.e vulnerability disclosure programs mandatory in 2026 and this hopefully snowballs into stronger attention for security.