Source: Patchstack, updated 25 February 2026 ยท read 8 November 2026
Where WordPress security problems come from, and what that means for your clients' sites
Mostly from add-ons, not from WordPress itself. In 2025, 91% of new WordPress vulnerabilities were in plugins and 9% in themes; WordPress core had 6, all low priority.
So every plugin a client site runs is one more thing someone has to keep updated.
The proof
The numbers, word for word
| What | Patchstack, word for word |
|---|---|
| New vulnerabilities in 2025 | "Overall 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 - that's a 42% increase compared to 2024." |
| How many were a real threat | "Of all new vulnerabilities found, 4,124 (36%) represented an actual threat" |
| Where they were | "91% of new vulnerabilities were found in plugins, and 9% were found in themes." "There were only 6 vulnerabilities reported in the WordPress core, but these were low priority issues." |
| No fix in time | "46% of vulnerabilities did not receive a fix from the developer in time for public disclosure." |
| How fast, for the most targeted holes | "Median time to mass exploitation for heavily exploited vulnerabilities is 5 hours" (weighted by observed attack activity; not every hole is attacked that fast) |
What it means for you
The upkeep lives in the plugins
On WordPress, core is well looked after. The work is the plugins and themes on each client site: watch for updates, apply them, check nothing broke, and act fast when a fix is late.
On iNterGine there are no third-party plugins or themes to install. The store, booking, forms, members area, blog and phone app are part of the platform, and iNterGine updates the platform: "No third-party plug-ins, no outsourcing, nothing for the customer to install, patch or update" (www.intergine.com).
Fair is fair
Where WordPress is better
- Its core team keeps core tight: 6 low-priority core issues in a whole year.
- Its plugin choice is the biggest there is.
Method and sources
How we know this
- Patchstack: State of WordPress Security in 2026, page updated 25 February 2026, every quote checked word for word in a browser on 8 November 2026.
- iNterGine: www.intergine.com, read 8 November 2026.
- More guides: Guides for webmasters, What WordPress maintenance involves, What a website costs on Wix, WordPress.com and iNterGine.