WordPress Vulnerabilities: 10,943 CVEs in 2026 So Far, 90% in Plugins, and 3 Core Flaws Now Exploited
WordPress vulnerabilities reached 10,943 published CVEs between January 1 and Oct 29, 2026, up 20% on the same period of 2025, according to our analysis of the NIST National Vulnerability Database. Plugins account for 89.5% of them and WordPress core for just 9, yet 3 of those core flaws are now on CISA’s list of vulnerabilities exploited in the wild.
We pulled every CVE published to the NVD from January 1, 2018 to Oct 29, 2026 that identifies WordPress core, a WordPress plugin, or a WordPress theme, 39,265 records in all, and matched them to CISA’s Known Exploited Vulnerabilities catalog and to install counts from the WordPress.org plugin directory. Nearly half of these records (47%) never use the word “WordPress” in their description, so a simple keyword search of the NVD misses them.
How many WordPress vulnerabilities are published each year?
Plugins Themes WordPress core
CVEs by NVD publication date. *2026 runs to Oct 29, 2026. The dashed line on the 2025 bar marks the same January 1 to Oct 29 period. Source: NIST NVD API 2.0; analysis by The Uptime Report.
The count grew slowly until 2020 and then climbed every year as WordPress security firms became CVE Numbering Authorities and began issuing identifiers in bulk: 1,024 in 2021, 4,081 in 2023, and 11,069 in 2025. With two months left, 2026 is 126 CVEs short of the 2025 total.
WordPress components went from 1.5% of all CVEs published to the NVD in 2018 to 23.0% in 2025, roughly one CVE in four. In 2026 the share fell to 12.3%, not because WordPress counts dropped but because total NVD publications jumped to 89,079 through Oct 29, a surge we track in our CVE statistics for 2026. For the same months of 2025 the WordPress share was 23.1%.
| Year | Plugin | Theme | Core | WordPress total | All NVD CVEs | WordPress share | Critical (CVSS 9+) | No privileges needed | NIST-analyzed |
|---|---|---|---|---|---|---|---|---|---|
| 2018 | 226 | 2 | 18 | 246 | 16,510 | 1.5% | 10.2% | 62% | 100% |
| 2019 | 895 | 49 | 23 | 967 | 17,305 | 5.6% | 14.9% | 84% | 100% |
| 2020 | 236 | 12 | 21 | 269 | 18,322 | 1.5% | 17.8% | 68% | 100% |
| 2021 | 992 | 24 | 8 | 1,024 | 20,149 | 5.1% | 7.2% | 43% | 100% |
| 2022 | 1,724 | 27 | 9 | 1,760 | 25,073 | 7.0% | 7.4% | 49% | 100% |
| 2023 | 4,006 | 71 | 4 | 4,081 | 28,816 | 14.2% | 5.9% | 50% | 100% |
| 2024 | 8,607 | 291 | 8 | 8,906 | 39,953 | 22.3% | 7.9% | 42% | 58% |
| 2025 | 10,250 | 816 | 3 | 11,069 | 48,151 | 23.0% | 7.0% | 50% | 19% |
| 2026* | 9,794 | 1,140 | 9 | 10,943 | 89,079 | 12.3% | 9.7% | 56% | 0% |
*2026 through Oct 29, 2026. Critical uses the CVSS v3.x base score from NIST where present, otherwise the score from the issuing CNA (v4.0 as a fallback). “No privileges needed” is the share whose CVSS vector has PR:N. NIST-analyzed is the share with an “Initial Analysis” event in the NVD change history.
Plugins, themes and core: where the flaws are
Since 2018, 36,730 of 39,265 WordPress CVEs (93.5%) affected plugins, 2,432 (6.2%) affected themes and 103 (0.26%) affected WordPress core. Themes are a growing slice: 816 theme CVEs in 2025 and 1,140 so far in 2026, up from 71 in 2023.
WordPress core produced 3 CVEs in 2025 and 9 so far in 2026. Low volume has not meant low risk this year: CVE-2026-63030 (a REST API batch endpoint route confusion, CVSS 9.8 from the CNA) and CVE-2026-60137 (a SQL injection in WP_Query) were published together on July 17 and added to CISA’s exploited list four days later, and CVE-2026-87902, a local file inclusion in page-template resolution, followed in September.
What kinds of WordPress vulnerabilities are most common?
Weakness categories of 10,943 WordPress CVEs published January 1 to Oct 29, 2026, sized by count. Hover for counts and the 2024 share.
Categories group CWE identifiers from the NVD record (NIST’s CWE first, otherwise the CNA’s). Broken access control covers CWE-862, 863, 284, 285, 639, 266 and related IDs; full mapping in the methodology.
Cross-site scripting has been the default WordPress bug for years: 45.6% of WordPress CVEs in 2024. In 2026 it dropped to 28.9% and broken access control, mostly missing authorization checks on AJAX and REST handlers, rose to 29.3%. Cross-site request forgery fell from 13.6% in 2025 to 3.6%. The shift sits in two CNAs’ records: in Patchstack’s, XSS went from 39% in 2025 to 26% in 2026, and in WPScan’s from 63% to 17%, while Wordfence’s stayed near 40%. That points to a change in which reports get a CVE rather than proof that plugin code got safer against XSS.
| Weakness category | 2022 | 2023 | 2024 | 2025 | 2026* | 2026 count |
|---|---|---|---|---|---|---|
| Cross-site scripting (XSS) | 43.0% | 38.9% | 45.6% | 40.4% | 28.9% | 3,163 |
| Cross-site request forgery (CSRF) | 18.5% | 23.1% | 10.4% | 13.6% | 3.6% | 394 |
| Broken access control | 6.4% | 7.2% | 21.3% | 19.4% | 29.3% | 3,205 |
| SQL injection | 8.5% | 5.7% | 4.7% | 5.7% | 8.1% | 883 |
| Arbitrary file upload | 2.2% | 1.5% | 2.9% | 2.2% | 2.2% | 243 |
| Path traversal and file inclusion | 2.6% | 0.8% | 3.7% | 7.8% | 8.5% | 929 |
| Code and command injection | 1.1% | 0.6% | 1.3% | 1.3% | 1.9% | 205 |
| Object injection (deserialization) | 1.1% | 1.1% | 2.0% | 2.4% | 4.6% | 507 |
| Information exposure | 2.1% | 1.8% | 3.2% | 2.8% | 4.6% | 502 |
| Authentication bypass | 1.2% | 0.9% | 1.6% | 1.0% | 3.0% | 328 |
| Server-side request forgery (SSRF) | 0.9% | 0.6% | 0.9% | 1.2% | 1.5% | 161 |
| Open redirect | 0.4% | 0.8% | 0.3% | 0.4% | 0.2% | 23 |
| Other weakness | 5.0% | 1.1% | 1.1% | 0.8% | 2.5% | 274 |
| No CWE assigned | 6.9% | 16.0% | 0.8% | 0.9% | 1.2% | 126 |
How severe are WordPress vulnerabilities?
Most are rated Medium. Of the 10,943 WordPress CVEs published in 2026, 5,697 are Medium, 3,956 High and 1,057 Critical (9.7%), against 772 Critical (7.0%) in all of 2025. The most common weakness types among 2026’s Critical WordPress CVEs were object injection (245), SQL injection (209), broken access control (187) and arbitrary file upload (157).
A rising share can be triggered without an account. 56% of 2026 WordPress CVEs carry a CVSS vector with no privileges required, up from 50% in 2023. These are flaws an attacker can attempt against any site running an affected version without first obtaining an account.
Who scores them: NIST has stepped back
Share of WordPress CVEs, by publication year, with an NVD “Initial Analysis” event; label under each year is the median days from publication to that analysis. Source: NVD CVE Change History API.
Until 2023 NIST analyzed every WordPress CVE, typically within a week (median 6 days for 2023 CVEs). Coverage fell to 58% for 2024 CVEs, with a median wait of 107 days, then 19% for 2025. For 2026, 50 of 10,943 have been analyzed and 10,882 are marked Deferred. In practice every severity score on a recent WordPress CVE is the issuing CNA’s own. Teams that filter on NVD “Critical” through the API’s NIST-score filter will see almost nothing.
Who finds and reports WordPress vulnerabilities?
Three WordPress security vendors run the CVE pipeline for the ecosystem. Each is a CVE Numbering Authority, which means it can assign CVE identifiers and publish the records itself. Patchstack issued 19,212 of the 39,265 WordPress CVEs since 2018, Wordfence 11,832 and WPScan 6,185. Before 2021, nearly all came through MITRE. The CNA is the organization that assigned the identifier, not necessarily the researcher who found the bug.
| CNA (share of WordPress CVEs) | 2021 | 2022 | 2023 | 2024 | 2025 | 2026* | Total since 2018 |
|---|---|---|---|---|---|---|---|
| Patchstack | 3% | 22% | 53% | 51% | 63% | 46% | 19,212 |
| Wordfence | 15% | 10% | 22% | 40% | 31% | 33% | 11,832 |
| WPScan | 73% | 65% | 23% | 9% | 5% | 18% | 6,185 |
| MITRE | 6% | 0% | 0% | 0% | 0% | 0% | 1,458 |
| VulnCheck | 0% | 0% | 0% | 0% | 0% | 2% | 181 |
| All others | 3% | 4% | 3% | 1% | 0% | 0% | 397 |
The CNAs also publish their own databases and annual reports. Patchstack’s 2026 whitepaper, for example, counts 11,334 new WordPress ecosystem vulnerabilities in 2025, split 91% plugins and 9% themes; our NVD count for 2025 is 11,069, with 92.6% in plugins. The two measure slightly different things (database entries versus published CVEs), and we use only the NVD records as data.
Most-installed WordPress plugins with critical CVEs in 2025 and 2026
Install counts turn a CVE list into an exposure list. We matched each 2025 to 2026 plugin CVE to its WordPress.org directory slug and pulled the active install count the directory reports. The largest exposure from a single critical bug was ElementsKit Elementor Addons, at 1,000,000+ active installs (CVE-2026-23693, CVSS 10.0).
| Plugin | Active installs | Critical CVEs | Highest-scored CVE | CVSS | Weakness | CNA | Published |
|---|---|---|---|---|---|---|---|
ElementsKit Elementor Addonselementskit-lite |
1,000,000+ | 1 | CVE-2026-23693 |
10.0 | Authentication bypass | VulnCheck | Feb 23, 2026 |
W3 Total Cachew3-total-cache |
900,000+ | 4 | CVE-2026-18051 |
10.0 | Path traversal and file inclusion | WPScan | Aug 19, 2026 |
WPvividwpvivid-backuprestore |
900,000+ | 3 | CVE-2024-56273 |
9.8 | Broken access control | Patchstack | Jan 7, 2025 |
Click to Chatclick-to-chat-for-whatsapp |
600,000+ | 1 | CVE-2026-92097 |
9.1 | Code and command injection | Wordfence | Oct 14, 2026 |
Database Addon for Contact Form 7contact-form-cfdb7 |
600,000+ | 1 | CVE-2025-4665 |
9.6 | SQL injection | Mandiant | Oct 29, 2025 |
Forminator Formsforminator |
600,000+ | 3 | CVE-2026-15748 |
9.8 | Arbitrary file upload | Wordfence | Aug 18, 2026 |
The Events Calendarthe-events-calendar |
600,000+ | 5 | CVE-2026-78265 |
9.8 | Object injection | Patchstack | Aug 24, 2026 |
Broken Link Checkerbroken-link-checker |
500,000+ | 1 | CVE-2026-18937 |
9.0 | Code and command injection | WPScan | Aug 19, 2026 |
Kirkikirki |
500,000+ | 3 | CVE-2026-8206 |
9.8 | Broken access control | Wordfence | Jun 2, 2026 |
Slider, Gallery, and Carousel by MetaSliderml-slider |
500,000+ | 2 | CVE-2025-26763 |
9.8 | Object injection | Patchstack | Feb 22, 2025 |
Ninja Formsninja-forms |
500,000+ | 2 | CVE-2026-65048 |
9.3 | Cross-site scripting (XSS) | VulnCheck | Jul 21, 2026 |
Ocean Extraocean-extra |
400,000+ | 1 | CVE-2025-3472 |
9.8 | Code and command injection | Wordfence | Apr 22, 2025 |
TranslatePresstranslatepress-multilingual |
400,000+ | 2 | CVE-2026-78267 |
9.8 | Broken access control | Patchstack | Aug 24, 2026 |
Blocksy Companionblocksy-companion |
300,000+ | 3 | CVE-2026-58480 |
9.8 | Arbitrary file upload | VulnCheck | Jul 8, 2026 |
Breeze Cachebreeze |
300,000+ | 1 | CVE-2026-3844 |
9.8 | Arbitrary file upload | Wordfence | Apr 23, 2026 |
Post SMTPpost-smtp |
300,000+ | 1 | CVE-2025-11833 |
9.8 | Broken access control | Wordfence | Nov 1, 2025 |
Templatelytemplately |
300,000+ | 1 | CVE-2025-49408 |
10.0 | Information exposure | Patchstack | Aug 20, 2025 |
Unlimited Elements for Elementorunlimited-elements-for-elementor |
300,000+ | 1 | CVE-2026-103355 |
9.3 | SQL injection | Patchstack | Oct 4, 2026 |
WP Activity Logwp-security-audit-log |
300,000+ | 2 | CVE-2025-0767 |
9.8 | Object injection | Fluid Attacks | Feb 27, 2025 |
Burst Statisticsburst-statistics |
200,000+ | 1 | CVE-2026-8181 |
9.8 | Authentication bypass | Wordfence | May 14, 2026 |
Plugins listed on WordPress.org with at least one CVE scored 9.0 or higher, published January 1, 2025 to Oct 29, 2026, ranked by active installs (WordPress.org reports rounded bands such as “900,000+”). Excludes 2 CVEs with pre-2024 identifiers that were published late and cover older releases (for example CVE-2012-10025, published in 2025, which affects Advanced Custom Fields 3.5.1 and below). 278 of 1,494 critical plugin CVEs could not be matched to a directory slug, mostly commercial plugins sold outside WordPress.org. Install counts retrieved Oct 29, 2026.
Critical bugs are only part of the picture. Counting every severity, 45 plugins with one million or more active installs had at least one CVE published in 2025 or 2026, 194 CVEs between them. They include Elementor Website Builder, Contact Form 7, Yoast SEO, WooCommerce, LiteSpeed Cache, WPForms, All-in-One WP Migration and Backup, Site Kit by Google. A single flaw in any of these lands on a large share of the sites an MSP manages.
Which WordPress vulnerabilities are actively exploited?
CISA’s Known Exploited Vulnerabilities catalog lists flaws with reliable evidence of exploitation. Of 1,764 entries (catalog version 2026.10.29), 6 are WordPress CVEs, 0.34% of the catalog against WordPress’s 23% share of 2025 CVEs. Three are plugin flaws added on the catalog’s launch day in November 2021; the other 3 are WordPress core flaws added in 2026, each with a remediation deadline of three to fourteen days for federal agencies. KEV is built for federal systems and is not a census of WordPress attacks, so a missing plugin is not evidence that it is safe. Our analysis of the full KEV catalog covers how entries are added.
| CVE | KEV name | Component | NVD published | Added to KEV | Ransomware use |
|---|---|---|---|---|---|
CVE-2020-25213 |
WordPress File Manager Plugin Remote Code Execution Vulnerability | Plugin | Sep 9, 2020 | Nov 3, 2021 | Unknown |
CVE-2020-11738 |
WordPress Snap Creek Duplicator Plugin File Download Vulnerability | Plugin | Apr 13, 2020 | Nov 3, 2021 | Unknown |
CVE-2019-9978 |
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | Plugin | Mar 24, 2019 | Nov 3, 2021 | Unknown |
CVE-2026-41940 |
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | Hosting panel (not counted) | n/a | Apr 30, 2026 | Known |
CVE-2026-60137 |
WordPress Core SQL Injection Vulnerability | WordPress core | Jul 17, 2026 | Jul 21, 2026 | Unknown |
CVE-2026-63030 |
WordPress Core Interpretation Conflict Vulnerability | WordPress core | Jul 17, 2026 | Jul 21, 2026 | Unknown |
CVE-2026-87902 |
WordPress Core Remote File Inclusion Vulnerability | WordPress core | Sep 22, 2026 | Sep 25, 2026 | Unknown |
Includes every KEV entry whose CVE is in our WordPress set or whose KEV vendor, product, name or description mentions WordPress. CVE-2026-41940 affects the cPanel and WP2 hosting control panels, not WordPress itself, and is not counted.
For broader context on exploited-before-patch bugs across vendors, see our zero-day statistics.
What this means for MSPs
- Keep a plugin inventory across every client site. 8,618 distinct plugin slugs appear in the advisories for WordPress CVEs published in 2025 or 2026, 7,911 of them in the WordPress.org directory. Without a per-site list of plugins and versions, there is no way to tell which of the roughly 231 WordPress CVEs published each week since January 2025 apply to you.
- Turn on plugin auto-updates where you can. WordPress has offered per-plugin automatic updates since version 5.5 and runs them twice a day by default, but they are opt-in plugin by plugin. Pair them with backups, which WordPress’s own documentation recommends before enabling them.
- Hunt for abandoned and closed plugins. Of the 7,911 plugins with a 2025 to 2026 CVE that we found in the WordPress.org directory, 3,012 (38%) are now closed to downloads, 2,646 of them for a security issue. A closed plugin gets no updates through the dashboard, so auto-updates cannot fix it. Another 637 plugins that are still listed have not been updated in more than two years. Replace or remove both.
- Put a WAF in front of sites you cannot patch quickly. 56% of 2026 WordPress CVEs need no login to exploit. A web application firewall with virtual patching rules covers the gap between disclosure and a tested update, and covers premium plugins whose updates arrive outside the dashboard.
- Count blast radius, not CVEs. One plugin bug can hit every client that runs that plugin. Rank exposure by how many of your sites run each affected plugin, the same way the table above ranks it by global installs. Premium plugins and themes matter too: the Rank Math SEO PRO package compromise in October 2026 (
CVE-2026-111862) involved malware in a subset of version 3.0.123 packages downloaded or updated on October 15 and 16, according to the CVE record: the WordPress version of the problem we documented in malicious npm packages. - Do not wait for NVD severity. NIST has analyzed 50 of this year’s WordPress CVEs. Use the CNA’s score in the NVD record, or the CNA’s own feed, to triage.
Frequently asked questions
How many WordPress vulnerabilities were published in 2026?
10,943 WordPress CVEs were published to the NIST National Vulnerability Database from January 1 to Oct 29, 2026, 20% more than the 9,100 in the same period of 2025. The 2025 full-year total was 11,069, the highest in our series.
Are most WordPress vulnerabilities in plugins?
Yes. In 2026 so far, 9,794 of 10,943 WordPress CVEs (89.5%) affect plugins, 1,140 (10.4%) affect themes, and 9 affect WordPress core. Since 2018, plugins account for 93.5% of 39,265 WordPress CVEs.
What is the most common type of WordPress vulnerability?
Cross-site scripting has led for years, at 45.6% of WordPress CVEs in 2024. In 2026 it fell to 28.9%, and broken access control (missing authorization checks and similar flaws) edged ahead at 29.3%.
Which WordPress vulnerabilities are exploited in the wild?
CISA’s Known Exploited Vulnerabilities catalog (version 2026.10.29, 1,764 entries) lists 6 WordPress CVEs: 3 plugin flaws added when the catalog launched in November 2021 and 3 WordPress core flaws added in 2026. That is 0.34% of the catalog.
Who assigns CVEs to WordPress vulnerabilities?
Three WordPress security firms that are CVE Numbering Authorities: Patchstack (49% of all WordPress CVEs since 2018), Wordfence (30%), and WPScan (16%). Together they issued 98.1% of 2026’s WordPress CVEs.
Does NIST score WordPress CVEs?
Rarely, now. Only 50 of the 10,943 WordPress CVEs published in 2026 have received an NVD initial analysis, and 10,882 carry the status Deferred. Severity scores on recent WordPress CVEs come from the CNA that issued them.
Methodology
Sources. NIST National Vulnerability Database CVE API 2.0 and CVE Change History API, retrieved October 29 to 30, 2026; CISA Known Exploited Vulnerabilities catalog JSON feed (version 2026.10.29); WordPress.org Plugins API 1.2 (plugin_information and query_plugins), retrieved October 30, 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Candidate pool. Every non-rejected CVE published January 1, 2018 to Oct 29, 2026 returned by any of: NVD keywordSearch=WordPress (120-day windows); NVD virtualMatchString for cpe:2.3:a:wordpress:wordpress and for any CPE with target software wordpress; and every record from the three WordPress-focused CNAs (sourceIdentifier Patchstack, Wordfence, WPScan). 39,370 unique records.
Matching rule. A CVE counts if at least one is true: (1) the English description contains “WordPress” (case-insensitive, also “Word Press”); (2) a vulnerable CPE in the NVD configuration is wordpress:wordpress or has target software wordpress; (3) a reference URL points to a WordPress component page: wordpress.org/plugins or /themes, plugins/themes/core.trac.wordpress.org, plugins/themes.svn.wordpress.org, patchstack.com/database/wordpress/…, a patchstack.com/database/vulnerability/ advisory titled “wordpress-…”, a wpscan.com/vulnerability/ advisory, or a wordfence.com/threat-intel/vulnerabilities/ advisory. Rule 3 is necessary: 47% of matched CVEs, mostly Patchstack’s, do not contain the word WordPress in their description.
Component. Plugin or theme if the description says “plugin/theme for WordPress”, “WordPress plugin/theme”, or “… plugin … for WordPress”; otherwise core if the opening of the description names WordPress itself with a version, “WordPress Core”, or “WordPress is vulnerable” (and no plugin or theme is named first), or if NIST’s CPE is wordpress:wordpress with such wording, or the Patchstack advisory is under /wordpress/wordpress/; then plugin or theme from the advisory URL path or CPE target software; then from the first of “plugin” or “theme” in the description. Records that mention WordPress but describe ecosystem tooling (WP-CLI, WordPress Coding Standards, hosting toolkits) or lacked any component signal were excluded. Records matched only through NIST’s CPE target software (179) were kept only when the description carries a WordPress cue (plugin, theme, wp-admin, WooCommerce, shortcode and similar) and names no other platform, because NIST also tags some Jenkins plugins and standalone PHP apps with that target; 95 were dropped, about half of them genuine plugins on our reading, so the rule slightly undercounts. 103 records were excluded in all. Two PHPMailer CVEs that NIST maps to WordPress core remain counted as core.
Precision and recall tests. We drew a random sample of 150 matched CVEs (seed 20261030) and read each description and advisory URL: all 150 described a WordPress plugin, theme or core flaw, and all 150 component labels agreed with the issuing CNA’s advisory. Every in-window record from Wordfence (11,832), WPScan (6,185) and Patchstack (19,212) matched the rule. All 2018 to 2026 CVEs NIST tags with the WordPress core CPE were labeled core, except one Elementor Pro widget flaw that the description shows is a plugin bug. We also read all 84 records kept through the CPE-only route: each is a WordPress plugin, theme or core record. A keyword-only search would have missed 18,349 records.
Definitions. Year is NVD publication year, not the year in the CVE ID; 129 of 2026’s records carry IDs from 2023 or earlier (mostly VulnCheck backfills of old exploits). Severity is the CVSS v3.x base score from NIST if present, else from the CNA, else CVSS v4.0; Critical is 9.0 or higher. Weakness category: first CWE in the record (NIST first, then CNA) mapped as XSS 79/80/83/87; CSRF 352; broken access control 862/863/284/285/639/266/269/250/280/425/732/276/281/602; SQL injection 89/564; file upload 434; path traversal and file inclusion 22/23/24/29/35/36/73/98; code and command injection 74/77/78/94/95/96/1336; object injection 502; information exposure 200/201/209/215/312/359/497/532/538/548/552; authentication bypass 287/288/290/294/302/304/305/306/307/620/640; SSRF 918; open redirect 601. NVD analysis lag is days from publication to the first “Initial Analysis” event in the NVD change history. Plugin slugs come from the advisory URLs; 41 more were matched by exact plugin name through the WordPress.org search API. Active installs are WordPress.org’s rounded bands at retrieval and describe the plugin today, not the affected versions. “Not updated in two years” means a last_updated date before October 29, 2024.
Limitations. CVE counts measure disclosure activity, which depends on CNA policies and bug bounty incentives, as much as underlying risk. Many WordPress vulnerabilities in vendor databases never receive a CVE. CNA scores are not independently checked. Install counts exist only for plugins in the WordPress.org directory. KEV is a federal catalog and undercounts exploitation of small plugins.
Not advice. This is an analysis of public vulnerability data, not a security assessment of any site.
Cite as:The Uptime Report. “WordPress Vulnerabilities: 10,943 CVEs in 2026 So Far, 90% in Plugins, and 3 Core Flaws Now Exploited.” October 2026. https://theuptimereport.com/wordpress-vulnerabilities/
References
- NIST, National Vulnerability Database, CVE API 2.0. Accessed October 2026.
- NIST, NVD CVE Change History API. Accessed October 2026.
- CISA, Known Exploited Vulnerabilities Catalog (JSON feed, version 2026.10.29). Accessed October 2026.
- WordPress.org API, Plugins API 1.2 (api.wordpress.org/plugins/info/1.2/). Accessed October 2026.
- WordPress.org, Plugin and themes auto-updates. Accessed October 2026.
- Patchstack, State of WordPress Security in 2026 (context only). Accessed October 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- IC3 Report 2025
IC3 losses, crime types, states per capita - AI Incidents Statistics 2026
AI incidents by year, harm type, company - Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced - Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation - DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains - RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV - Identity Theft Statistics 2026
ID theft per 100K by state and type - Scam Statistics 2026
FTC fraud losses by channel and age - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- OpenAI Outage History
1,051 OpenAI incidents, causes coded - Data Center Construction Spending 2026
Data center build spending, Census monthly - Microsoft End of Support 2026
Every 2026 Microsoft support cutoff - Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers - 5G Coverage Map 2026
5G by state and carrier, FCC data - Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines - Mac Market Share 2026
Mac desktop share by country and version - Browser Market Share 2026
Browser share since 2009, by platform - Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google - CrowdStrike Outage
July 19, 2024 outage, minute by minute - Data Center Electricity Prices 2026
Power prices vs data center load, by state - Average Internet Bill 2026
Home internet prices by speed and state - Search Engine Market Share 2026
Search share since 2009, by country - ChatGPT Market Share 2026
AI chatbot referral share, every tracker - Google Cloud Outage History
Google Cloud incidents by product, 2013 on - Azure Outage History
Every Azure PIR, coded by root cause - Data Center Water Usage 2026
Water by site, company and drought - AI Energy Consumption 2026
Big Tech electricity vs US demand - SSD Prices 2026
NAND price cycle from makers’ filings - RAM Prices 2026
DRAM prices from producers’ filings - Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- State Privacy Laws 2026
23 state privacy laws, compared - State AI Laws 2026
131 state AI laws, dates and penalties - FedRAMP Statistics 2026
FedRAMP authorizations, GSA data - Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- Most Popular Programming Languages 2026
Language ranks by country, GitHub data - Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024 - Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS - Web Developer Salary 2026
Web dev vs software pay by state, BLS - AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job - Network Engineer Salary 2026
Network engineer vs admin pay, BLS - IT Manager Salary 2026
IT manager pay by industry, BLS OEWS - Software Engineer Salary 2026
Developer pay by metro, BLS OEWS - H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- AI Capex 2026
Big Tech capex vs cash flow, SEC data - Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks - Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation - Computer Prices 2026
Computer price indexes and HS 8471 imports - MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply