11,334 WordPress flaws in a year, and only six were in WordPress itself

01The market moved to hosted builders

W3Techs reports each CMS’s share among the websites in its survey whose CMS it can identify. On its 1 January snapshots, WordPress fell from a peak of 65.2% in 2022 to 63.7% in 2023 and 60.2% in 2026. Over the same three years from the original post, Shopify rose from 5.7% to 7.0%, Wix from 3.6% to 5.8% and Squarespace from 3.0% to 3.4%, while Joomla slid from 2.7% to 1.9% and Drupal from 1.8% to 1.1%.¹

Four of the 2023 ten, Magento, Ghost, Sitecore and Umbraco, do not appear among the systems W3Techs charts by year, which tells you something too: they are specialist tools for a store, a publication or a large enterprise build, not general answers to “we need a website”. Magento is now sold as Adobe Commerce, and Sitecore and Umbraco are usually bought as part of a partner-led build.

WordPress’s own number deserves a careful reading. A fall from 63.7% to 60.2% of CMS-run sites is small in points and large in sites, and it is not a verdict on the software. WordPress still runs three in five CMS sites, and managed WordPress hosting blurs the line between the two camps. What the chart does show is where new sites go: to products that bundle hosting, templates, security fixes and a payment page into one monthly bill.¹

02The patch queue sits in the plugins

“Security” was one of the five factors in 2023, stated as “strong security measures”. The numbers since make it more specific. Patchstack, which runs a vulnerability database and bug-bounty programme for WordPress, counted 7,966 new vulnerabilities in the WordPress ecosystem in 2024, 96% of them in plugins, 4% in themes and seven in core; a third were not fixed by the time they were made public.² Its 2025 count was 11,334, up 42%: 91% in plugins, 9% in themes, six in core, and 46% unfixed at public disclosure.³

Two further lines in the 2025 report matter to a buyer. Patchstack rated 1,966 of the year’s flaws, 17%, as highly exploitable, the kind used in automated mass attacks, and that count rose 113% on the year. And paid “premium” plugins and themes were not safer: they produced 29% of valid reports, three-quarters of them exploitable.³

The practical reading for a self-hosted site is about counts and speed. Every plugin you add is a supplier whose fixes you must apply; automatic updates for minor releases close most of the window, but only if someone checks that they ran and that the site still works afterwards. A plugin that has not shipped an update in a year is a liability whatever its rating, because nearly half of 2025’s flaws were public before a fix existed.³ The cheapest control is the shortest plugin list the site can live with.

Drupal and Joomla do not escape the arithmetic; they simply have smaller plugin markets. What they add is version risk. Drupal 7 lost security support on 5 January 2025.⁴ Any site still on it is now unpatched by definition, whatever the plugin count.

03What the hosted camp charges to take that job away

The hosted builders sell exactly what the patch chart describes: someone else applies the fixes. Their entry plans are cheap enough that the comparison is with an hour of a developer’s time a month, not with the open-source licence, which is free. WordPress.com, the hosted service from WordPress’s parent company, lists a Personal plan at US$4 a month billed annually and Business at US$25.⁵ Squarespace shows Indian visitors rupee prices, from ₹630 a month billed annually for Basic, which carries a 2% fee on store sales.⁶ Ghost(Pro), the publishing platform from the 2023 list, starts at US$18 a month for one staff user.⁷

The hosted plans have their own limits, and they are worth reading before the first page is built. Entry tiers cap what you can install or customise, store plans add a transaction fee on sales until you move up a tier, and every builder decides which exports it supports. None of that is a reason to self-host a five-page company site; all of it is a reason to choose the tier on the features you will need in a year, not the ones you need at launch.

The enterprise end of the 2023 list, Sitecore and Adobe’s experience platform, is a different purchase: a digital-experience suite sold on a project quote with personalisation, analytics and commerce modules. TechBag scopes those for Indian buyers on the Adobe Experience Cloud page; for a marketing team that wants CMS pages wired into its CRM, HubSpot Content Hub is the middle path.

04Five questions to replace the five factors

The 2023 factors were sound but unmeasurable. These are the questions we would put to any CMS shortlist now, each with an answer you can check.

1. Who applies security fixes, and how fast? On a hosted builder it is the vendor. On a self-hosted site, name the person, and the time from a plugin fix to production.
2. How many third-party components will the site run? Count plugins, themes and modules at launch. Each is a separate supplier on Patchstack’s chart.
3. Is the version still supported? Drupal 7’s end of support is the cautionary tale; check the core version’s end date before you inherit a site.
4. Where do form submissions and logs go? Contact and lead forms collect personal data; a hosted builder decides where it is stored unless you route it elsewhere.
5. Can you leave? Export of pages, media and URLs without a rebuild. Open-source systems win this question; check what each builder exports.

For a self-hosted estate, a web-application scanner closes the gap between “a plugin fix exists” and “we know we are running the vulnerable version”. TechBag’s vulnerability management guide lists the scanners that test web applications and APIs as well as servers.