State of WordPress Security in 2025

7966 vulnerabilities found, 33% unpatched when disclosed. 99.9% of those vulnerabilities are coming from third-party plugins/themes. Plugin developers really need to step up their security game.

I'm guessing "still really bad."