wordfence / statistics · 19,433 indexed

Wordfence statistics

Live view of the WordPress plugin and theme vulnerability ecosystem, pulled from Wordfence Intelligence.

sync synced Oct 16, 00:24Z
total vulns
19,433
since 2025
critical
949
4% of total
high
4,477
23%
popular affected
1,112
10k+ installs
patched
67%
13,053 fixed · 6,380 open
01

Distribution

severity · monthly
monthly discoveries last 12 mo
severity share
critical 949 · 4%
high 4,477 · 23%
medium 13,933 · 71%
low 74 · 0%
02

Trends

yearly · patched share
vulnerabilities by year 2 years
patched status 13,053 / 19,433
03

Hot zones

CWE classes · top plugins
top CWE classes top 20
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 6,628
CWE-862 · Missing Authorization 3,773
CWE-352 · Cross-Site Request Forgery (CSRF) 1,720
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 1,353
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 1,147
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor 739
CWE-502 · Deserialization of Untrusted Data 692
CWE-639 · Authorization Bypass Through User-Controlled Key 538
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 477
CWE-434 · Unrestricted Upload of File with Dangerous Type 435
top vulnerable plugins by vuln count
Tutor LMS – eLearning and online course solution
tutor · 100,000 installs
1 crit 6 high 51
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
user-registration · 50,000 installs
3 crit 4 high 50
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
wp-event-solution · 10,000 installs
1 crit 12 high 50
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
forminator · 600,000 installs
2 crit 20 high 49
LatePoint – Calendar Booking Plugin for Appointments and Events
latepoint · 100,000 installs
2 crit 17 high 48
GiveWP – Donation Plugin and Fundraising Platform
give · 100,000 installs
3 crit 8 high 44
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
learnpress · 70,000 installs
1 crit 3 high 42
Kirki – Freeform Page Builder, Website Builder & Customizer
kirki · 500,000 installs
3 crit 11 high 39
MasterStudy LMS WordPress Plugin – for Online Courses and Education
masterstudy-lms-learning-management-system · 10,000 installs
1 crit 3 high 38
WordPress
wordpress · 0 installs
1 crit 5 high 38
JetEngine
jet-engine · 0 installs
1 crit 24 high 37
Simply Schedule Appointments
simply-schedule-appointments · 50,000 installs
15 high 37
Royal Addons for Elementor – Addons and Templates Kit for Elementor
royal-elementor-addons · 600,000 installs
6 high 35
ProfileGrid – User Profiles, Groups and Communities
profilegrid-user-profiles-groups-and-communities · 5,000 installs
2 crit 3 high 34
Booking for Appointments and Events Calendar – Amelia
ameliabooking · 90,000 installs
1 crit 7 high 33
04

Top 10 plugins · chart

vulnerabilities · descending
top 10 by vuln count horizontal bars
05

Popular plugin alerts

10k+ installs · high impact
critical · popular10k+
949
125 affecting widely-used plugins
high · popular10k+
1,099
amber-zone risk · 10k+ install reach
browse popular→
view advanced plugins →
filterable table · severity · CWE · install threshold