I mapped every WordPress plugin CVE since 2023. Here's what the data says — and how I built it.
Most "is this plugin safe?" advice is vibes. I wanted numbers, so I built a dataset. Here's what it found, and exactly how, so you can check my work or build your own. The finding first Of 8,010 WordPress plugins with a publicly documented vulnerability since 2023 (15,534 vulnerability records in total): 3,780 have been removed from the wordpress.org plugin directory. Removal stops updates but…
In 2023, a researcher mapped every WordPress plugin containing a documented vulnerability. Of the 8,010 plugins examined, 3,780 were removed from the wordpress.org plugin directory. However, removal only stops updates, not uninstallation, meaning affected sites continue running the code. Surprisingly, 2,115 plugins remain installable with known vulnerabilities despite not receiving updates for over a year—this amounts to roughly 6.7 million active installs.
The most concerning aspect is that removal from the directory is largely unseen by site owners; there are no dashboard warnings or emails notifying them. To build this dataset, the researcher utilized two public sources, avoiding paid APIs and no API keys. The first source was the GitHub Advisory Database, which mirrored CVE records, including Patchstack and Wordfence CNA assignments.
The second source was the wordpress.org plugin API, which provided installation count, last-updated date, tested-up-to version, and support-thread resolution ratio. By combining vulnerability load and maintenance factors, the researcher constructed a score that accurately reflects a plugin's current situation rather than its worst historical moment.
The full index, detailing each plugin's CVE timeline and scoring method, is available for public viewing.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
