I mapped every WordPress plugin CVE since 2023. Here's what the data says — and how I built it.

Most "is this plugin safe?" advice is vibes. I wanted numbers, so I built a dataset. Here's what it found, and exactly how, so you can check my work or build your own.

The finding first

Of 8,010 WordPress plugins with a publicly documented vulnerability since 2023 (15,534 vulnerability records in total):

3,780 have been removed from the wordpress.org plugin directory. Removal stops updates but doesn't uninstall — affected sites keep running the code.

277 carried a critical (CVSS ≥ 9.0) flaw on record before removal.

I mapped every WordPress plugin CVE since 2023. Here's what the data says — and how I built it.

Other newsrooms on this story

Related reading

AI found 300 WordPress plugin zero-days in 72 hours. I build plugins. Here's…

WordPress security: the 10-minute monthly checklist that catches real problems

Almost half the WordPress plugin directory has not been updated in two years

Hackers are mass-exploiting two WordPress vulnerabilities

WP Maps Pro WordPress flaw exploited to create admin accounts

I Benchmarked 17 ESLint Security Plugins. Only One Found Every Vulnerability.