Patchstack 2026: 91% of new WordPress vulnerabilities are in plugins; only 6 CVEs in core

Quote (Patchstack, State of WordPress Security in 2026): "91% of new vulnerabilities were found in plugins, and 9% were found in themes. There were only 6 vulnerabilities reported in the WordPress core."

Source: https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/

Confidence: Verified (primary).

Mechanism: Each plugin is a separate attack surface, maintained by a separate developer (or no developer). A 30-plugin WordPress site has 30 attack surfaces; a custom Next.js site has its own npm dependency tree but no plugin-as-extension model.

Note: Industry rules-of-thumb circulate (20-30 plugins average per business site; WPBeginner runs 62; FatLab Web Support reports 80+ extra files loaded on heavy plugin sites). Those are industry-consensus rules-of-thumb, not measured installed-base data — no host publishes hard averages.