To help you save time reading, here are the key findings:
26% of plugins with critical security bugs never received a patch.
Compared to the 1,382 confirmed security bugs in WordPress plugins they added to their database in 2021, Patchstack added 4,528 of them in 2022 – a rise of 328%.
The WordPress core platform itself was responsible for only 0.6% of the security bugs. Themes accounted for 6.7% and plugins were the main culprit with 93%.
Unpatched security bugs are especially common in third-party plugins and themes that extend WordPress functionality but may not receive regular updates or support from their creators.
Therefore, it is important for WordPress site owners to keep their plugins and themes updated regularly and use a web application firewall (WAF) to block hacking attempts.
