WordPress security vulnerabilities surged in 2021, with nearly 1,500 new vulnerabilities added to the Patchstack database — a 150% increase over 2020. Plesk's WP Toolkit is now integrating Patchstack's vulnerability data to scan hosted WordPress sites automatically. For resellers managing WordPress infrastructure, this matters.
At a glance
- Patchstack vulnerability database shows 150% increase in WordPress vulnerabilities vs 2020
- 1,500 new vulnerabilities added to Patchstack in 2021 (vs ~600 in 2020)
- 91.79% of vulnerabilities found in wordpress.org-hosted plugins and themes
- Remaining 8.21% in premium or marketplace plugins/themes
- WP Toolkit now runs hourly scans against Patchstack data
- Vulnerabilities flagged directly in WP Toolkit interface
- $13,000 in bug bounties paid by Patchstack Alliance in 2021
The Scale of the Problem
WordPress powers roughly 43% of all websites, and 65% of CMS-based sites. Those numbers make WordPress a massive target. The Patchstack data shows the attack surface is growing fast: nearly three times as many new vulnerabilities in 2021 versus 2020.
The distribution is telling. Almost all vulnerabilities (91.79%) come from the wordpress.org plugin and theme repository — free or low-cost options that don't go through the same security review processes as premium products. This doesn't mean premium plugins are immune, but the risk concentration in free repository assets is significant.
How WP Toolkit Vulnerability Scanning Works
Hourly checks against the Patchstack database scan for known vulnerabilities in WordPress core, installed plugins, and themes. When a match is found, WP Toolkit flags the affected site in the control panel interface, alerting you or your client that action is needed.
The scan doesn't patch automatically. It surfaces the problem. From there, updating the vulnerable component is still manual — but at least you're notified rather than relying on a client to report an exploit after the fact.
The Patchstack Partnership
Patchstack operates as a CVE-authorized numbering authority for WordPress vulnerabilities, meaning they can assign official tracking IDs to WordPress-related security issues. They've also built a bug bounty community that paid $13,000 in bounties in 2021, with brands like Plesk and cPanel supporting the program.
Why This Matters for Resellers
You probably can't manually audit every plugin across every client WordPress installation. Automated vulnerability scanning fills that gap. When a vulnerable plugin hits the news, you need to know which of your client sites are affected — not discover it after an exploit.
Build vulnerability scanning into your standard WordPress hosting stack. If your current provider doesn't offer it, WP Toolkit on Plesk-based hosting does.
Key takeaways
- WordPress vulnerability counts tripled in 2021; assume plugins are a constant risk vector
- Automatic scanning catches vulnerable components before exploits happen
- WP Toolkit scans hourly against Patchstack database, flagging issues in the control panel
- Free repository plugins carry the highest vulnerability concentration
- Vulnerability scanning should be standard in any WordPress hosting offering
Frequently asked questions
Does WP Toolkit automatically patch vulnerable plugins?
No. It scans hourly and flags vulnerabilities in the interface. Manual updates are still required.
Are premium plugins safer than free ones?
Not necessarily, but premium plugins represent a smaller attack surface (8.21% of vulnerabilities). Security depends on active maintenance, not pricing model.
What does a CVE-authorized numbering authority do?
It can assign official CVE identifiers to WordPress vulnerabilities, enabling standardized tracking and communication about specific security issues.
How often does WP Toolkit scan for vulnerabilities?
Hourly checks against the Patchstack database, with new vulnerability data fetched hourly as well.
Can I offer vulnerability scanning to my clients?
Yes, if you use Plesk with WP Toolkit enabled. Some managed WordPress hosts offer similar tools.