The popular belief is that WordPress core — the software itself — is the weak link. But that’s largely a myth. According to Patchstack’s security research, 96% of all vulnerabilities discovered in the WordPress ecosystem live in plugins and themes, not in core. WordPress core had fewer than 25 vulnerabilities in 2025, most of which were low-severity. The real danger is in the extended ecosystem.