How Many WordPress Vulnerabilities Appear in a Week

Wordfence Intelligence’s weekly reports for 2026 add up to 9,184 new vulnerabilities across 40 weeks, about 230 a week. The number keeps climbing, from 179 a week between January and June to 324 since July, and 512 and 655 in the last two weeks we checked. Most are in plugins, though in some weeks themes take a large share too.

A separate report counted about 11,000 for all of 2025 by its own method, so the totals are not directly comparable. Because the flaws are mostly in plugins, keep every plugin updated and remove the ones you don’t use. Wordfence’s API and CLI scanner are free, including for commercial use, and can check a site’s plugins against the database automatically, which beats reading the feed by hand.