Common · most WordPress flaws
Vulnerable WordPress plugins and themes
A WordPress site is mostly other people’s code. A flaw in one plugin can give an attacker the same access as a flaw in PHP, and WordPress won’t always warn you.
Why it matters to you
Most small business sites carry a dozen or more plugins, and each one is another place for a flaw. Abandoned plugins are the riskiest, because a flaw may never be fixed.
Check it yourself
- 01List every plugin and theme with its version (Plugins, Installed).
- 02Search each one in a vulnerability database such as Patchstack or WPScan.
- 03Mark anything inactive, unused or no longer maintained.
Fix it
- 01Update plugins and themes. Do it on a copy for anything that runs checkout or forms.
- 02Delete what you don’t use, and replace plugins that are no longer maintained.
- 03Turn on automatic updates for low-risk plugins, and keep backups you’ve test-restored.
- 04Use strong admin passwords and two-step login.
How PatchRig helps
PatchRig checks your plugins and themes against public vulnerability data, updates on a copy first, and removes what you don’t need.