Live data · source: NVD

WordPress and Joomla vulnerability statistics

We continuously track vulnerabilities in the WordPress and Joomla core and their plugins. Below is a complete, up-to-date picture of the threat landscape: the most common flaw types, the most frequently vulnerable components and the trend over time.

Database: 1 714 vulnerabilities · last updated: October 22, 2026

1 714
vulnerabilities tracked
23%
are critical flaws
8.2
average CVSS score
89%
affect WordPress

Most common flaw types

How attackers most often target WordPress and Joomla sites, based on classified vulnerabilities.

Cross-site scripting (XSS) 336
Remote code execution (RCE) 246
SQL injection 193
Privilege escalation 101
Authentication bypass 60
CSRF (request forgery) 46
Account takeover 37
Arbitrary file upload 33

Most frequently vulnerable plugins and components

Named plugins and extensions with the highest number of reported vulnerabilities. If you use any of them, check that you are on the latest version.

  1. Gravity Forms9 vulnerabilities
  2. Super Forms – Drag & Drop Form Builder7 vulnerabilities
  3. Forminator Forms – Contact Form, Payment Form & Custom Form Builder7 vulnerabilities
  4. WP Directory Kit WordPress7 vulnerabilities
  5. User Registration & Membership WordPress7 vulnerabilities
  6. Frontend Admin by DynamiApps7 vulnerabilities
  7. miniOrange 2FA WordPress6 vulnerabilities
  8. Kirki – Freeform Page Builder, Website Builder & Customizer6 vulnerabilities
  9. TranslatePress – Translate Multilingual sites with AI Translation6 vulnerabilities
  10. Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress5 vulnerabilities
  11. Mang Board5 vulnerabilities
  12. Groundhogg — CRM, Newsletters, and Marketing Automation5 vulnerabilities
  13. Online Scheduling and Appointment Booking System – Bookly5 vulnerabilities
  14. TrueBooker – Appointment Booking and Scheduler System5 vulnerabilities
  15. InfusedWoo Pro5 vulnerabilities

New vulnerabilities over time

Number of newly reported WordPress and Joomla vulnerabilities month by month.

1 Feb 25
9 Apr 26
136 May 26
113 Jun 26
325 Jul 26
404 Aug 26
367 Sep 26
359 Oct 26

Data source: the public NVD (NIST) vulnerability catalog. We include WordPress and Joomla vulnerabilities rated CVSS ≥ 7.0 (high and critical), accumulated over time and updated automatically. This overview is indicative and does not replace an audit of a specific site. We share the data under the CC BY 4.0 license; you may cite and reuse it with attribution (a link to FixWeb24).

Full list of current threats → Plugin security → Scan your website →
Do not guess, check

Does any of these flaws affect your website?

We will run a free audit: we check versions, plugins and configuration, and tell you plainly whether you are secure.

Request a free audit →