- Wordfence recorded 655 vulnerabilities for October 5 to 11, 2026, across 406 plugins and 100 themes in the wider WordPress ecosystem, not in any single site.
- Wordfence says free users receive new firewall rules after a 30-day delay, while paid tiers get them immediately.
- Leaders should ask for a plugin inventory, a named owner for each add-on, and a measured time from disclosure to update.
A WordPress site is a bundle of parts
A WordPress site is rarely one product. It is the core software plus plugins and themes, each written and updated by a different party. A flaw in any one of those parts can affect the whole site.
Think of a car assembled from parts made by different companies. A recall on one part matters to every owner whose car uses it, even if the rest of the car is sound.
Wordfence's weekly report for October 5 to 11, 2026 shows the scale of the wider ecosystem. Wordfence added 655 vulnerabilities to its Intelligence database for that week. They were found in 406 plugins and 100 themes, and 236 researchers contributed.
Those 506 plugins and themes are counted across all of WordPress. They are not the parts of any one site. The report does not say how many add-ons a typical site runs. Your own number is a question for your team.
Two entries, two different mechanisms
The report names two issues. The first is in WordPress core versions 7.1 to 7.1.2: an unauthenticated stored cross-site scripting flaw reached through pending comments. Unauthenticated means no login is needed. Stored means the site saves the attacker's script and runs it later in another person's browser. Pending comments are those waiting for approval.
The second is in Abandoned Cart Pro for WooCommerce, version 10.8.0 and earlier. It is an unauthenticated SQL injection through the guest persistent cart's meta_value field. SQL injection means crafted input changes the database query the site runs. A store's database holds its customer and order records.
The page text we reviewed gives no severity scores, no CVE IDs and no exploitation status for either issue. We therefore make no claim about how severe they are.
The count depends on where you look
WebPulse's profile of WordPress in the NIST National Vulnerability Database shows 3 CVEs in the last 12 months. Wordfence recorded 655 vulnerabilities in a single week. These come from different databases with different scope, so they are not a like-for-like comparison.
The gap shows that what you see depends on which database you consult. A team that tracks only the core platform in a national database sees a short list. A team that also tracks plugins and themes sees a longer one. The same profile lists 4 WordPress entries in CISA's Known Exploited Vulnerabilities catalog. That figure is cumulative, not weekly.
Why the add-on question is common
Tracking add-ons is not a niche task. In WebPulse's September 2026 scan of the Tranco top 10,000 domains, 7,064 responded and a platform was detected on 2,491. WordPress made up 719 of those, or 28.9%. That percentage covers detected sites in this sample, not the web.
Where a platform is this common, many organisations face the same add-on question. Each of them must know which plugins and themes it runs. The sample does not show how many of those sites use any affected add-on.
Protection that arrives on a schedule
Wordfence says its team wrote firewall rules for selected vulnerabilities last week. Premium, Care and Response customers received them immediately. Users of the free version receive them after a 30-day delay.
That is a vendor policy, and the vulnerability database, API and webhooks are free. A firewall rule is also a stopgap while an update is pending. Leaders should know which tier their sites use.
Questions to put to your team
First, how many plugins and themes do our sites run, and who owns each one? Second, which of them handle logins, payments or customer data? Third, does anyone receive vulnerability alerts in real time? Wordfence offers a free webhook for this.
Fourth, how many days pass between a disclosure and our update, and who measures it? Fifth, which firewall tier do we use, and have we accepted what a 30-day gap means?
You can only update what you know you run. Start with the list.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
