WordPress Vulnerability Statistics
As of November 6, 2026, WordSec tracks 43,644 disclosed WordPress vulnerabilities: 2,906 critical, 9,130 high, 31,412 medium and 196 low; 40,510 affecting plugins, 2,750 affecting themes and 418 affecting WordPress core; credited to 3,977 security researchers, going back to the earliest record on June 9, 2003.
How many WordPress vulnerabilities are known?
WordSec's catalog holds 43,644 disclosed vulnerabilities across WordPress plugins, themes and core releases, with the oldest dating to June 9, 2003. It was last updated on November 6, 2026.
- Records
- 43,644
- Researchers
- 3,977
How severe are they?
2,906 are rated critical and 9,130 high, which together are 28% of the catalog. Severity follows the CVSS score published with each record.
- Critical
- 2,906
- High
- 9,130
- Medium
- 31,412
- Low
- 196
What do they affect?
40,510 records affect plugins, 2,750 affect themes and 418 affect WordPress core. A single vulnerability can affect more than one asset, so these are record counts rather than distinct pieces of software.
- Plugins
- 40,510
- Themes
- 2,750
- Core
- 418
Who reports them?
3,977 named security researchers are credited across the catalog. Every record links to the person who reported it, and every researcher has a profile listing their disclosures.
- Credited researchers
- 3,977
Can I use these numbers in my own tool?
Yes. The same figures are available as JSON, without an API key, and the endpoints are described by an OpenAPI document so an agent can call them without guessing. Credit and a link back are the only thing asked in return.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C