Plugins are the #1 attack surface on WordPress. Core gets patched quickly; plugins — especially abandoned ones — accumulate known vulnerabilities that never get fixed.
Our plugin vulnerability rankings track every plugin in our database by known CVE count, cross-referenced with EPSS exploit probability and CISA's Known Exploited Vulnerabilities catalog. Here's what stands out.
Popularity is not safety
The plugins with the most CVEs aren't obscure. Many are household names with millions of active installs — which is exactly why they're targeted. A vulnerability in a plugin with 5 million installs is worth exploiting; a vulnerability in a plugin with 500 installs isn't.
But the reverse is also true: some of the most dangerous plugins are small, abandoned, and quietly running on sites that forgot they exist.
The pattern that matters: old versions
In our scan data, the sites that get flagged for plugin vulnerabilities almost always share one trait: they're running versions that are several releases behind. The CVE was fixed months ago — the site just never updated.
This is the most fixable problem in WordPress security:
- Enable auto-updates for plugins (or at least minor versions)
- Remove plugins you don't use — an inactive plugin is still attackable
- Check the last-updated date before installing anything new; a plugin untouched for 2+ years is a liability
How to check your own site
Every plugin page in our index shows the full CVE list: severity, CVSS score, affected version range, fixed version, and EPSS percentile. For example, you can look up any plugin's profile at /blog/wordpress-security-index/plugins/<plugin-slug>.
But the fastest way to know if your site is exposed is a scan. ThreatSpot detects your installed plugins and cross-references them against the full CVE database — no manual version checking required.
The takeaway
The WordPress plugin ecosystem has a long-tail vulnerability problem. The fix isn't exotic — it's hygiene:
- Keep plugins updated
- Delete what you don't use
- Know what's installed
The plugin rankings are live and updated as new CVEs are published. Bookmark them, check your stack, and scan your site.