---
title: "11,334 WordPress flaws in a year, and only six were in WordPress itself"
summary: "W3Techs CMS share for the ten platforms this blog named in 2023, Patchstack's 2024 and 2025 WordPress flaw counts and entry prices, read for an Indian buyer as of September 2026."
url: https://www.thetechbag.com/blog/introduction-cms-tools-top-10-cms-platforms
format: Analysis
desk: "SaaS & business software"
published: 2025-08-14
facts_checked: 2026-09-30
author: TechBag (The TechBag Journal)
tags: ["CMS","WordPress","Wix","Squarespace","Drupal","Joomla","Ghost","Patchstack","plugins","CERT-In","DPDP"]
cover: https://www.thetechbag.com/blog/covers/introduction-cms-tools-top-10-cms-platforms.png
---

# 11,334 WordPress flaws in a year, and only six were in WordPress itself

*W3Techs CMS share for the ten platforms this blog named in 2023, Patchstack's 2024 and 2025 WordPress flaw counts and entry prices, read for an Indian buyer as of September 2026.*

Analysis · SaaS & business software · By TechBag · Published 2025-08-14 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/introduction-cms-tools-top-10-cms-platforms

The short version

- The real cost of a content management system is the patching it creates. Patchstack logged **11,334** new vulnerabilities in the WordPress ecosystem in 2025; 91% sat in plugins and only six in WordPress core.[3]
- Since this blog listed ten CMSs in 2023, the hosted builders gained share and the self-hosted open-source pair lost it: Wix went from 3.6% to 5.8% of CMS-run sites, Joomla from 2.7% to 1.9%, Drupal from 1.8% to 1.1%.[1]
- For an Indian business site, choose by who patches it. A hosted builder from US$4 or ₹630 a month moves that job to the vendor; a self-hosted WordPress, Drupal or Joomla site keeps it in-house, along with CERT-In’s six-hour reporting clock.

In April 2023 this blog published a list of ten CMS platforms, WordPress to Umbraco, with a paragraph of praise for each and five factors to weigh: ease of use, customisability, scalability, security and support. The question a reader was asking then is the one an Indian marketing or IT head still asks: which system should run the company website? Three and a half years on, the useful answer is not a ranking. It is that the list split into two camps, platforms you host and patch yourself and platforms someone else hosts and patches for you, and that the second camp has been winning while the first camp’s patch queue has grown.

## The market moved to hosted builders

W3Techs reports each CMS’s share among the websites in its survey whose CMS it can identify. On its 1 January snapshots, WordPress fell from a peak of 65.2% in 2022 to 63.7% in 2023 and 60.2% in 2026. Over the same three years from the original post, Shopify rose from 5.7% to 7.0%, Wix from 3.6% to 5.8% and Squarespace from 3.0% to 3.4%, while Joomla slid from 2.7% to 1.9% and Drupal from 1.8% to 1.1%.[1]

**Figure: Wix now runs more CMS sites than Joomla and Drupal combined; in 2019 it ran a fifth as many**

*Share of websites with an identified CMS, W3Techs snapshot on 1 January of each year, 2019 to 2026, %*

|  | Shopify | Wix | Joomla | Drupal |
| --- | --- | --- | --- | --- |
| 2019 | 2.6 | 1.8 | 5.4 | 3.5 |
| 2020 | 3.4 | 2.3 | 4.6 | 3 |
| 2021 | 5.2 | 2.4 | 3.6 | 2.5 |
| 2022 | 6.6 | 2.9 | 2.6 | 2 |
| 2023 | 5.7 | 3.6 | 2.7 | 1.8 |
| 2024 | 6 | 3.8 | 2.5 | 1.6 |
| 2025 | 6.7 | 4.6 | 2.2 | 1.3 |
| 2026 | 7 | 5.8 | 1.9 | 1.1 |

Source: W3Techs, historical yearly trends in CMS usage · as of 1 January 2026

Four of the 2023 ten, Magento, Ghost, Sitecore and Umbraco, do not appear among the systems W3Techs charts by year, which tells you something too: they are specialist tools for a store, a publication or a large enterprise build, not general answers to “we need a website”. Magento is now sold as Adobe Commerce, and Sitecore and Umbraco are usually bought as part of a partner-led build.

WordPress’s own number deserves a careful reading. A fall from 63.7% to 60.2% of CMS-run sites is small in points and large in sites, and it is not a verdict on the software. WordPress still runs three in five CMS sites, and managed WordPress hosting blurs the line between the two camps. What the chart does show is where new sites go: to products that bundle hosting, templates, security fixes and a payment page into one monthly bill.[1]

Our view

Our view: the share curve is a buying signal, not a popularity contest. Small and mid-sized businesses have decided that a website is a subscription, not a server. Joomla and Drupal remain good software, but the people choosing them now are mostly teams with developers on staff, which is exactly the condition the 2023 list never mentioned.

## The patch queue sits in the plugins

“Security” was one of the five factors in 2023, stated as “strong security measures”. The numbers since make it more specific. Patchstack, which runs a vulnerability database and bug-bounty programme for WordPress, counted 7,966 new vulnerabilities in the WordPress ecosystem in 2024, 96% of them in plugins, 4% in themes and seven in core; a third were not fixed by the time they were made public.[2] Its 2025 count was 11,334, up 42%: 91% in plugins, 9% in themes, six in core, and 46% unfixed at public disclosure.[3]

**Figure: New WordPress-ecosystem flaws rose 42% in a year, and those unpatched at disclosure roughly doubled**

*New vulnerabilities logged by Patchstack, and those not fixed by public disclosure, calendar 2024 and 2025*

|  | 2024 | 2025 | Change |
| --- | --- | --- | --- |
| New vulnerabilities | 7,966 | 11,334 | 42% |
| Not fixed at disclosure | 2,629 | 5,214 | 98% |

Source: Patchstack, State of WordPress Security in 2025 and in 2026; unfixed counts are TechBag arithmetic from Patchstack's percentages · as of 25 February 2026 · unfixed = 33% of 7,966 and 46% of 11,334, rounded

Two further lines in the 2025 report matter to a buyer. Patchstack rated 1,966 of the year’s flaws, 17%, as highly exploitable, the kind used in automated mass attacks, and that count rose 113% on the year. And paid “premium” plugins and themes were not safer: they produced 29% of valid reports, three-quarters of them exploitable.[3]

ReportedReported

WordPress core is not the problem; the ecosystem around it is. Six core vulnerabilities in 2025, all low priority, against 10,308 in plugins by Patchstack’s share.[3] A site with thirty plugins has thirty separate vendors’ release cycles to watch.

The practical reading for a self-hosted site is about counts and speed. Every plugin you add is a supplier whose fixes you must apply; automatic updates for minor releases close most of the window, but only if someone checks that they ran and that the site still works afterwards. A plugin that has not shipped an update in a year is a liability whatever its rating, because nearly half of 2025’s flaws were public before a fix existed.[3] The cheapest control is the shortest plugin list the site can live with.

Drupal and Joomla do not escape the arithmetic; they simply have smaller plugin markets. What they add is version risk. Drupal 7 lost security support on 5 January 2025.[4] Any site still on it is now unpatched by definition, whatever the plugin count.

## What the hosted camp charges to take that job away

The hosted builders sell exactly what the patch chart describes: someone else applies the fixes. Their entry plans are cheap enough that the comparison is with an hour of a developer’s time a month, not with the open-source licence, which is free. WordPress.com, the hosted service from WordPress’s parent company, lists a Personal plan at US$4 a month billed annually and Business at US$25.[5] Squarespace shows Indian visitors rupee prices, from ₹630 a month billed annually for Basic, which carries a 2% fee on store sales.[6] Ghost(Pro), the publishing platform from the 2023 list, starts at US$18 a month for one staff user.[7]

**Figure: A hosted site starts at the price of a team lunch; the open-source licence is free but the patching is not**

*Cheapest paid plan, per month billed annually, as printed on each vendor's pricing page, 2026*

US$4

WordPress.com Personal, a month

WordPress.com pricing

₹630

Squarespace Basic, a month, 2% store fee

Squarespace pricing (India)

US$18

Ghost(Pro) Starter, one staff user

Ghost pricing

₹0

WordPress.org, Drupal, Joomla licence; hosting and patching extra

open-source licences

Source: WordPress.com, Squarespace and Ghost pricing pages · as of 30 September 2026 · Squarespace shows INR to Indian visitors; the others list USD

Our view

Our view: for a brochure site, a blog or a small catalogue, a hosted builder is the better buy for most Indian businesses, because the cost it removes, a patch cycle nobody owns, is the one that ends in a defaced home page. Self-host when you need something the builders cannot do, such as custom integrations, a data-residency requirement, or an editorial workflow across many teams, and then budget for a named person and a vulnerability scanner, not just the server.

The hosted plans have their own limits, and they are worth reading before the first page is built. Entry tiers cap what you can install or customise, store plans add a transaction fee on sales until you move up a tier, and every builder decides which exports it supports. None of that is a reason to self-host a five-page company site; all of it is a reason to choose the tier on the features you will need in a year, not the ones you need at launch.

The enterprise end of the 2023 list, Sitecore and Adobe’s experience platform, is a different purchase: a digital-experience suite sold on a project quote with personalisation, analytics and commerce modules. TechBag scopes those for Indian buyers on the [Adobe Experience Cloud](https://www.thetechbag.com/adobe/adobe-experience-cloud) page; for a marketing team that wants CMS pages wired into its CRM, [HubSpot Content Hub](https://www.thetechbag.com/hubspot/hubspot-content-hub) is the middle path.

## Five questions to replace the five factors

The 2023 factors were sound but unmeasurable. These are the questions we would put to any CMS shortlist now, each with an answer you can check.

1. **Who applies security fixes, and how fast?** On a hosted builder it is the vendor. On a self-hosted site, name the person, and the time from a plugin fix to production.
2. **How many third-party components will the site run?** Count plugins, themes and modules at launch. Each is a separate supplier on Patchstack’s chart.
3. **Is the version still supported?** Drupal 7’s end of support is the cautionary tale; check the core version’s end date before you inherit a site.
4. **Where do form submissions and logs go?** Contact and lead forms collect personal data; a hosted builder decides where it is stored unless you route it elsewhere.
5. **Can you leave?** Export of pages, media and URLs without a rebuild. Open-source systems win this question; check what each builder exports.

For a self-hosted estate, a web-application scanner closes the gap between “a plugin fix exists” and “we know we are running the vulnerable version”. TechBag’s [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) lists the scanners that test web applications and APIs as well as servers.

If you are buying this in India

**Price and tax.** Most CMS subscriptions bill in US dollars on a card. A GST-registered Indian business buying a service from abroad pays 18% IGST under reverse charge and claims it back as input tax credit; buying through an Indian reseller replaces that with an INR invoice carrying 18% GST.[8] Where a vendor already shows rupee prices, as Squarespace does, check whether GST is included before comparing.

**The regulation that bites.** CERT-In’s Directions of 28 April 2022 list defacement of, or intrusion into, a website among incidents that must be reported within six hours of being noticed, and require ICT system logs to be kept for 180 days.[9] On a self-hosted site both duties are yours; on a hosted builder ask the vendor, in writing, what logs you can obtain and how quickly. Lead forms make the site a collector of personal data under the Digital Personal Data Protection Act, 2023; the DPDP Rules were notified on 13 November 2025, with the substantive security and breach-notice duties in force from 13 May 2027.[10]

How we did this

Figures as of 30 September 2026

Market share is W3Techs’ yearly series, read at each 1 January from 2019 to 2026; it measures share among websites whose CMS W3Techs can identify, not share of all websites, and its later monthly values were not used. Vulnerability counts and percentages are Patchstack’s, from its reports on 2024 and 2025; the “not fixed at disclosure” counts are TechBag’s arithmetic from Patchstack’s percentages, and the plugin count of 10,308 is 91% of 11,334. Patchstack sells WordPress security services. Prices are each vendor’s cheapest paid plan billed annually, from undated pricing pages; Wix, Shopify, Sitecore, Umbraco and Adobe Commerce were not priced here (Shopify’s Indian plans are covered in a separate piece). The 2023 post’s descriptions of each platform were dropped as unverifiable praise.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [W3Techs, Historical yearly trends in the usage statistics of content management systems (1 January values, 2015 to 2026)](https://w3techs.com/technologies/history_overview/content_management/ms/y) — 1 January 2026 snapshot
2. [Patchstack, State of WordPress Security in 2025 (7,966 new vulnerabilities in 2024; 96% plugins; 33% unfixed at disclosure)](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/) — updated 14 March 2025 Patchstack sells WordPress security services.
3. [Patchstack, State of WordPress Security in 2026 (11,334 new vulnerabilities in 2025; 91% plugins; 46% unfixed; 1,966 highly exploitable)](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) — updated 25 February 2026 Patchstack sells WordPress security services.
4. [Drupal.org, Drupal 7 end of life (security support ended)](https://www.drupal.org/about/drupal-7/d7eol/partners) — 5 January 2025
5. [WordPress.com, Pricing (Personal US$4, Premium US$8, Business US$25, Commerce US$45 a month billed annually)](https://wordpress.com/pricing/) — undated page
6. [Squarespace, Pricing as shown to Indian visitors (Basic ₹630, Core ₹720, Advanced ₹1,100 a month billed annually)](https://www.squarespace.com/pricing) — undated page
7. [Ghost, Ghost(Pro) pricing (Starter US$18, Publisher US$29, Business US$199 a month billed yearly)](https://ghost.org/pricing/) — undated page
8. [India Briefing, OIDAR services: GST and reverse charge](https://india-briefing.com/news/tax-digital-services-oidar-in-india-gst-applicability-and-compliance-22465.html) — 29 September 2023
9. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; 180-day logs; defacement listed)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
10. [MeitY, Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025; substantive duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that test web applications and APIs, not just servers
- [HubSpot Content Hub](https://www.thetechbag.com/hubspot/hubspot-content-hub) — CMS pages wired into the CRM, quoted in INR
- [Adobe Experience Cloud](https://www.thetechbag.com/adobe/adobe-experience-cloud) — the enterprise digital-experience suite, scoped by module