Of the 11,334 WordPress vulnerabilities in 2025, 91 percent were in plugins and six percent in the core. A median of five hours passes before the first exploitation. Therefore, anyone who wants to protect their website needs a regular routine instead of occasional update clicks.