Most WordPress Vulnerabilities Are in Plugins. A Static Site Runs None.
Patchstack counted 11,334 new WordPress vulnerabilities in 2025. Six were in WordPress itself. The rest came with the plugins and themes people add.
WordPress runs 35.6% of the websites in the HTTP Archive’s 2024 Web Almanac, over a third of them. Plugins are a large part of why. Whatever you want a site to do, someone has written a plugin for it, and installing one takes a minute.
Each plugin is also code from another author, running on your server on every visit, with access to your database.
Where the flaws are
Patchstack, which tracks WordPress security, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024. 91% were in plugins and 9% in themes. WordPress itself had six, all low priority. Patchstack judged 1,966 of them likely to be used in automated attacks on many sites at once (State of WordPress Security in 2026).
The core software is well looked after. The risk comes in with what people add to it.
A security plugin, of all things
In November 2024 a flaw was published in Really Simple Security, a plugin people install to make WordPress safer. On a site with its two-factor login switched on, an attacker could sign in as any user, administrators included, without a password. It scored 9.8 out of 10 (CVE-2024-10924). wordpress.org lists the plugin on more than three million sites today.
Version 9.1.2 fixed it. Every site still running an older copy stayed open until someone updated it.
What a static site runs
When someone visits, the server sends files. There is no PHP, no database and no plugin code for an attacker to reach, because none of it is there.
The jobs plugins used to do move elsewhere. Building the pages happens before the site goes live, in a container with no network access (secure builds). Forms, bookings and newsletter sign-ups go to services we run and patch ourselves, so there is no plugin of yours to keep up to date.
What it doesn’t fix
Your accounts still matter. Someone who gets into your GitHub or GitLab account, or your domain registrar, can change your site, so turn on two-factor sign-in there. A script you paste into your pages from another company runs in your visitors’ browsers; choose those the way you would choose a plugin.
Yesterday’s post covered what a static site is, and when you need something else.
Ready to Deploy?
Join Jamstack developers across the UK hosting their static sites with privacy and performance built in. Hosting is free for good, no credit card needed, with Plus features when you want them.
