- BugShield says its Scout agent verified 1,415 previously unreported findings in 938 of 15,282 WordPress.org themes. The figures are self-reported and the themes are not yet named.
- An empty vulnerability search means only that nobody has published a report. It does not show that a theme is safe.
- Leaders should list their themes and versions, check each for maintenance, and ask suppliers how they will handle private disclosures.
Search a vulnerability database for the theme your website runs. If nothing comes back, it is natural to feel reassured. The lesson of a new report from BugShield is that the reassurance is weaker than it feels. A database lists the flaws that people have already found and written up. It is silent about code nobody has read.
What BugShield reports
BugShield is a UK WordPress services firm. It says its research agent, Scout, read code from 15,282 themes in the public WordPress.org directory. The snapshot dates from 17 October 2026. BugShield says it verified 1,415 previously unreported findings across 938 of those themes.
These are the firm's own figures. BugShield says the official WordPress pages it links to give background only and do not confirm its numbers. The page also promotes the firm's developer services. Treat the findings as claims, not as an audited result.
How the filter works
Scout runs in stages. First come static checks, which scan code for patterns that often signal trouble. Then an AI model reviews the leads. Suspected weaknesses go to a local test. BugShield deploys the theme in an isolated WordPress environment and writes a proof-of-concept test. It counts a finding as verified only if the test shows the weakness under the right login and permission conditions.
The numbers narrow at each stage. BugShield says final automated review assessed 2,271 findings. It marked 1,436 as worth reporting. Of those, 21 matched advisories already published by Wordfence, so it removed them. That left 1,415.
The counts have limits. They measure findings, not separate bugs. If related themes share the same underlying mistake, each theme adds to the total. The count may therefore exceed the number of distinct flaws.
Coverage is also incomplete in places. The scanner read only part of 310 themes. A further 148 themes ended with an unfinished stored outcome.
How many sites could be involved
WordPress.org publishes rounded-down install counts for each theme. BugShield used a slightly later list of 939 themes to estimate reach. That is one theme more than the 938 verified themes, so the range is a close approximation, not an exact match.
Adding the published floors gives roughly 512,300 active installs. Adding the top of each band gives roughly 766,991. BugShield calls both figures approximations built from rounded bands. Each site runs one active theme, so nobody is counted twice.
Most themes on the list are small. The middle one has 90 active installs. But seven themes with 10,000 or more installs hold 54.7% of the floor total. BugShield stresses that these counts show who runs the theme, not who runs an affected version or has been attacked.
The idea: an empty search reflects attention, not safety
Here is the shift this report points to. A vulnerability database depends on human attention. Someone must read the code, spot the flaw and write it up. Attention goes first to popular software. A long tail of small themes may go unread, and an empty search in that tail tells you little.
Scout is one team's attempt to read a whole directory with software. If BugShield's claims hold, the report suggests that software can now cover code at that scale. That fits the idea that AI multiplies how much code can be examined. The caveats matter. The research is self-reported and unaudited. The report does not say that anyone else is doing this, or that any of these flaws has been exploited.
The next question is who acts on the findings. That falls to theme developers, and many run small projects. BugShield notes that 7,791 of the 15,282 themes show only their original directory date and are marked not recently updated. That is a maintenance signal, not proof of abandonment.
BugShield records no fixes yet. It says it is still preparing coordinated private disclosures, so patches are not expected to exist yet.
What leaders should ask
BugShield is withholding theme names until patches exist. That is standard disclosure practice, but it means nobody can check their own site yet. So the useful work is preparation.
First, ask your web team for a list of every theme in use, with versions. Include sites run by agencies or marketing teams. Second, ask which of those themes were updated in the past year, and who is accountable for each one. Third, ask how updates are tested and deployed, so a fix can ship within days of release. Fourth, ask your agency how it would handle a private disclosure about a theme it supplied.
BugShield's practical advice draws on official WordPress guidance. Install updates across the whole site, and favour extensions whose authors still maintain them. Its central point is that a search with no results means only that no report has been published.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: bugshield.co.uk.
