WordPress Itself Is Safe. Your Plugins Are the Risk

WordPress core is not the problem. Patchstack’s 2026 report found 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42 percent in a year. Only six of them were in WordPress core.

The rest sat in plugins and themes. But plugins alone accounted for 91 percent. Most small business sites run a dozen or more of them, so the risk adds up quickly.

Why small sites get hit

Attackers do not pick targets by name. Instead, they scan the web for sites that run a known vulnerable plugin. Many flaws also had no fix when they went public, so updating is not always enough. As a result, the plugins you choose matter as much as how often you update.

Supply-chain attacks add another risk. In April 2026, attackers compromised more than 20 plugins on the official plugin repository. Some sites installed the bad versions through automatic updates.

What to do

A few habits cut the risk sharply, so start here.

Remove plugins you do not use, because every plugin adds attack surface.
Check the last-updated date, because anything over 12 months old is suspect.
Update on a schedule, but test updates on a staging copy first.
Keep backups, then test a restore.
Use a security service that watches for known plugin flaws.
Name one person who owns updates, so nothing falls through the cracks.

Backups matter here for the same reason they matter against ransomware, as we covered in how backups decide the ransomware bill. For the wider picture, see what happens to a website nobody maintains.

FAQ

Is WordPress safe for a small business?

Yes, but only when someone maintains it. The core software has very few flaws. Neglected plugins cause most of the damage.

Should I turn on automatic plugin updates?

For low-risk plugins, yes. However, test major updates on a staging copy first. A bad update can break your site, and in rare cases it can carry malicious code.

Getting started

Zavix Media manages WordPress sites, including plugin audits, safe updates, and monitoring. Book a Free Call, and we will review which plugins on your site put you at risk.