WordPress Plugin Vulnerabilities: Why 96% of the Risk Lives in Your Add-ons

The number that should change how you think about WordPress

If you run a small-business website on WordPress, here is the single most useful fact to keep in mind about WordPress plugin vulnerabilities: plugins account for roughly 96% of WordPress vulnerabilities, and only a handful are ever found in WordPress core itself (Patchstack). In plain terms, the WordPress software you started with is rarely the weak point. The weak point is the collection of contact forms, booking calendars, page builders, SEO tools, and gallery plugins you added afterward.

That matters because it tells you exactly where to spend your limited time and attention. You do not need to become a security expert or rebuild your site. You need a sensible routine for the add-ons, because that is where the attackers are looking.

Why WordPress plugin vulnerabilities are the favourite way in

WordPress core is maintained by a large, professional team that reviews code carefully and ships security fixes quickly. Plugins and themes are a different world. Anyone can write one, and the WordPress plugin directory alone holds tens of thousands of them, written by everyone from full-time companies to weekend hobbyists.

The volume of new flaws is staggering and still climbing. Patchstack recorded nearly 8,000 new WordPress vulnerabilities in 2024, about a 34% increase on the year before (Patchstack, via SecurityWeek). The vast majority of those live in plugins and themes, not in core.

Attackers like this for a simple reason: scale. A single popular plugin can be installed on hundreds of thousands of sites. Find one flaw in it, and you have a master key that opens the same door on every site running that version. They do not need to target your business by name. They scan the whole internet looking for that one vulnerable plugin.

Abandoned plugins: the quiet danger

The most dangerous plugin on your site is often one you have completely forgotten about. A plugin becomes abandoned when its author stops releasing updates, sometimes because they moved on, sold the project, or simply lost interest.

An abandoned plugin still works, so nothing on your site looks broken. But when a new vulnerability is discovered in it, there is no one left to write a fix. The hole stays open indefinitely, and your site keeps running the flawed code month after month.

This is why a plugin you installed years ago for a one-time job, and never thought about since, can quietly become your biggest liability. If the WordPress directory shows a plugin has not been updated in over a year, or warns that it is no longer maintained, treat that as a red flag to replace or remove it.

How attackers know which version you are running

You might assume your plugins are a private detail, but many of them announce themselves to the outside world. This is called version fingerprinting, and it is easier than most owners realise.

Plugins frequently leave clues in plain sight: a version number in a CSS or JavaScript file path, a comment in your page's source code, a readme file left in a public folder, or a distinctive URL pattern. Automated tools read these clues, match them against public databases of known vulnerabilities, and build a target list in seconds.

This is exactly the gap a good security check is meant to close. A passive external scan like BadgerScan reads the same publicly visible clues an attacker would and flags any detectable versions with known issues. The catch is that the outside view can only see what is exposed publicly. To know the exact version of every plugin, theme, and the core itself, you have to look from the inside, which is what our read-only WordPress plugin does on the Pro plan. Combining both views is the only way to get the full picture in one place.

A simple plugin hygiene routine

You do not need a complicated security programme. You need a short, repeatable habit. Here is a routine any small-business owner can follow, no technical background required.

• Inventory everything. List every plugin and theme on your site, including the ones you are not actively using. You cannot protect what you have forgotten about.
• Update on a schedule. Apply plugin, theme, and core updates at least weekly. Most vulnerabilities are fixed by the author before attackers exploit them widely, so the fix only helps if you actually install it.
• Delete, do not just deactivate. A deactivated plugin still has its code sitting on your server, where a flaw can sometimes still be reached. If you are not using it, remove it completely.
• Check for abandonment. Twice a year, look up each plugin and confirm it is still maintained. Replace anything that has gone quiet for a year or more.
• Back up before you change anything. Keep a recent, tested backup so an update that goes wrong is an inconvenience, not a disaster.
• Turn on automatic updates for trusted plugins. For well-maintained add-ons from reputable authors, automatic updates close the gap between a fix being released and you installing it.

Why this matters more for small businesses

It is tempting to assume attackers only care about big companies, but the data points the other way. In Verizon's 2025 Data Breach Investigations Report, ransomware or extortion appeared in 88% of breaches at small and medium businesses, versus 39% at larger organizations (Verizon 2025 DBIR).

Small businesses are attractive precisely because they tend to have fewer defences and less time to maintain them. A neglected plugin on a local business website is a soft target. The good news is that the fix is almost entirely within your control: keep your add-ons current, remove what you do not need, and check your site from both the outside and the inside so nothing slips through.