WordPress Plugin Security Trends
What's broken in WordPress.org plugins right now, by the numbers. Aggregate findings from 500 independent audits across the last 5 days of audits.
Most common finding categories
% of audited plugins that ship with at least one finding in each category. Multiple categories can apply to the same plugin.
| Category | Prevalence |
|---|---|
| WordPress Compatibility | 100.0% |
| Security | 99.8% |
| Coding Standards | 99.4% |
| AI-Generated Code | 75.6% |
| Type Safety | 71.8% |
| Performance | 63.2% |
| Plugin Conflicts | 58.2% |
| Plugin Lifecycle | 55.4% |
| Theme Standards | 50.8% |
| Internationalization | 49.4% |
| compatibility | 49.2% |
| Hook Wiring | 45.2% |
Risk distribution
Overall risk verdict across the sample — the audit's worst finding tier drives the label.
Methodology
Statistics are computed from the last 500 public, completed plugin audits run by WP HealthKit, deduplicated by plugin (each plugin contributes its most recent audit only). Audits run a multi-engine pipeline including deterministic scanners (Wordfence CVE database, OSV, PHPCS, PHPStan, Semgrep, Psalm, hardcoded-secret detection across 22 patterns); AI-powered analysis (security, code quality, accessibility) runs on full audits, while continuous fleet monitoring audits are deterministic-only — the sample reflects both.
“Prevalence” measures the percentage of plugins that contain at least one finding in a given category. A single plugin can contribute to multiple category counts but contributes at most once per category, so the percentages don't sum to 100.
Cached at 1-hour granularity. Re-audits are deduplicated by plugin slug (we count each plugin's most recent audit, not historical re-audits).
Want to cite this data? Link to wphealthkit.com/stats/trends. Released under CC-BY 4.0 — attribution requested but not enforced. Email jamie@builtbygo.com if you need raw figures or want to discuss methodology.
Want to know where your plugin sits in these numbers?
Free audit — no signup required to see your overall score and headline findings.
Run a free audit