WordPress.org

Security Scorecard

Score

34D

Total CVEs

888

Patch Rate

46%

412 patched

Avg Response

104d

days to patch

Critical Gaps

8

exploitable, no detection

Severity Breakdown

Critical39
High156
Medium691
Low2

Patch Status

Patched412 (46%)
Partial/Workaround4 (0%)
Unpatched472 (53%)

CVEs (1,100)

CVE IDTitleSeverityScoreDaysPatch
CVE-2024-29094HT Easy GA4 Plugin XSSHigh7.1-Patched
CVE-2022-1952WordPress Plugin XSSCritical9.8-Patched
CVE-2022-1589Change wp-admin login WordPress Plugin VulnerabilityHigh7.51325dUnpatched
CVE-2021-24863WP Block VulnerabilityCritical9.81495dUnpatched
CVE-2021-24767WordPress Plugin XSSMedium6.5-Patched
CVE-2017-18577Mailchimp-for-WP Cross-Site Scripting (XSS)Medium6.1-Patched
CVE-2017-18536WordPress Plugin XSSMedium6.1-Patched
CVE-2016-10871Mailchimp-for-WP XSS VulnerabilityMedium6.1-Patched
CVE-2025-13740-N/A-0dUnpatched
CVE-2025-12684-N/A-0dUnpatched