Are WordPress plugins safe to use?

Most are, when they come from reputable developers and are kept updated. The risk comes from outdated versions, abandoned plugins and pirated copies. Choose plugins with recent updates and active support, install as few as you need, delete what you do not use, and apply updates promptly with a backup in place. Safety depends far more on maintenance habits than on WordPress itself.

How do I know if a WordPress plugin is abandoned?

On its WordPress.org page, look for a warning that it has not been tested with the latest 3 major WordPress releases, a last-updated date long in the past, or support questions left unanswered. A red notice means the plugin has been closed. Any of these signs means you should plan to replace it with a maintained alternative before a new flaw appears.

What is a nulled plugin?

A nulled plugin is a pirated copy of a paid plugin with its licence check removed, usually shared on unofficial download sites. These copies often carry hidden code such as backdoors, spam links or redirects, and they never receive official security updates. Using one also breaks the developer's licence terms. If you find one on your site, delete it, scan for malware and change your passwords.

Should I turn on automatic plugin updates?

For small, well-maintained plugins, automatic updates are usually a good idea because security fixes arrive within hours. For large plugins such as page builders or e-commerce tools, many owners prefer to update manually after a backup, or test on a staging copy first. Whatever you choose, make sure someone checks the site after updates so a broken form is noticed quickly.

Does WordPress core have two-factor authentication?

No. WordPress core does not include built-in two-factor login, so you need a trusted security or 2FA plugin to add it. Two-factor authentication is one of the most effective protections for admin accounts, because a stolen password alone is no longer enough to log in. Apply it to every account with administrator or editor rights.

Is a security plugin enough to protect my site?

A security plugin helps with scanning, login protection and firewall rules, but it does not replace updates, backups or removing risky plugins. It is one layer. You still need current software, strong passwords with two-factor login, an off-server backup and someone who reviews alerts. A security plugin that nobody checks gives a false sense of safety.

When should I get professional help?

Get help if your site has been flagged by Google, shows redirects or spam pages, has unknown admin users, or if you do not have time for monthly updates. Professional help is also worth it before major changes such as a theme switch or moving hosts. A maintenance plan costs less than repeated cleanups and lost leads while the site is down.

Speed & Security

WordPress Plugin Vulnerabilities Explained: What Small Business Owners Need to Check and Fix

By ITCM Team · Updated November 2026

A WordPress plugin vulnerability is a security flaw in an add-on that attackers can use to break into your site, inject spam, steal form data or redirect visitors. Plugins are the biggest risk because almost every WordPress site runs many of them, written by different developers with very different standards. Patchstack counted 11,334 new WordPress vulnerabilities disclosed in 2025, and 91% were in plugins, not WordPress itself. The good news: most of the risk is manageable. Know what you have installed, remove what you do not use, update on a schedule, and keep a working backup.

Key takeaways

Plugins, not WordPress core, account for about nine in ten disclosed WordPress vulnerabilities.
Patchstack found heavily exploited flaws were mass-attacked within a median of about 5 hours of disclosure in 2025.
Abandoned and nulled (pirated) plugins are the highest-risk items on a typical small business site.
Fewer, well-maintained plugins beat a long list of single-purpose add-ons.
Always back up before updating, and test the site straight after.
For simple service businesses, a custom-coded site removes the plugin layer entirely.

Why are plugins the biggest WordPress security risk?

WordPress core is maintained by a large team and patched quickly. Patchstack's State of WordPress Security in 2026 report counted only 6 core vulnerabilities in 2025, all low priority, against 11,334 vulnerabilities overall. Around 91% sat in plugins and about 9% in themes.

Each plugin is extra code running with access to your database and admin area. A booking form, a slider, a page builder and an SEO tool may come from four different companies. If any one of them makes a mistake, the whole site is exposed. That is why the number and quality of plugins matter more than the WordPress version alone.

How fast do attackers exploit a new plugin flaw?

Very fast. Patchstack reports that for heavily exploited vulnerabilities in 2025, the weighted median time to mass exploitation was about 5 hours, and roughly half of high-impact flaws were exploited within 24 hours. Attacks are automated bots scanning millions of sites, not a person choosing your business.

Patchstack also found that 46% of vulnerabilities had no fix from the developer when they were made public. In those cases updating is not enough: you need to disable or replace the plugin, or use a firewall rule that blocks the attack until a patch arrives.

Small sites are not too small to target: bots do not check your revenue.
A weekend without updates can be enough for a known flaw to be used.
Unpatched flaws need a decision: remove, replace or shield the plugin.

What are abandoned and nulled plugins, and why avoid them?

An abandoned plugin is one the developer no longer maintains. WordPress.org shows a warning when a plugin has not been tested with the latest 3 major WordPress releases, and closed plugins show a red notice saying they are no longer available. If a flaw is found later, nobody will fix it.

A nulled plugin is a pirated copy of a paid plugin, offered free with the licence check removed. Imunify360 analysed a nulled Elementor Pro copy that faked its licence, redirected template requests to a third-party server and switched off SSL verification, meaning the operator could change what the site loaded at any time. Nulled files are a common route for backdoors and spam injections. The money saved is never worth it.

Plugin type	Risk level	What to do
Popular, updated in the last few months	Lower	Keep updated, review yearly
Premium plugin bought from the vendor	Medium	Keep licence active so updates arrive
Not tested with the last 3 WordPress releases	High	Find a maintained replacement
Closed or removed from WordPress.org	Very high	Remove now
Nulled or downloaded from an unofficial site	Critical	Delete, scan and change passwords

How do I check if my WordPress plugins are vulnerable?

You do not need to be technical to run a basic check. Start in your WordPress dashboard and work through this list once a month.

Open Plugins and note any with an update available; outdated versions are the most common problem.
Look up each plugin on WordPress.org and check the last update date and the compatibility warning.
Install a reputable security plugin or use your host's scanner, which compares your versions against known vulnerability databases.
Check Tools then Site Health for warnings about inactive or outdated plugins and themes.
Run the free SSL and security headers checker to confirm HTTPS and basic protections are in place.
Watch for the signs your website has been hacked, such as strange redirects or new admin users.

How do I update WordPress plugins safely?

Updates fix security holes but can occasionally break a layout or a form. A simple routine keeps both risks low.

Take a full backup of files and database first, and make sure it is stored away from the server.
Update one plugin at a time when possible, starting with security fixes.
After each update, check the home page, a contact form and any booking or checkout flow.
Use a staging copy for large updates such as page builders or WooCommerce.
Turn on automatic updates for small, well-maintained plugins you trust.
Keep the licence active on premium plugins, or updates stop arriving.

How many WordPress plugins is too many?

There is no magic number. A site with 10 well-maintained plugins can be safer than one with 5 abandoned ones. What matters is how much third-party code you run and how well each piece is maintained. Still, every plugin adds update work, possible conflicts and possible slowdowns, so fewer is generally better.

A practical rule: if you cannot say in one sentence why a plugin is installed, it should probably go. Deactivated plugins should be deleted too, because their files stay on the server and can still contain vulnerable code. Fewer plugins also help page speed, which matters for both visitors and Google.

What should I do if a plugin on my site is exploited?

Act quickly but calmly. The aim is to stop the damage, clean the site and close the hole that let the attacker in.

Put the site in maintenance mode or ask your host to isolate it.
Change all passwords: WordPress admins, hosting, database, FTP/SFTP and email.
Update or remove the vulnerable plugin and delete any unknown admin accounts.
Restore a clean backup from before the infection, or have the files cleaned professionally.
Scan again, then request a review in Google Search Console if Google flagged the site.
Follow the full steps in our guide on how to recover a hacked website.

Is a custom-coded website safer than WordPress with plugins?

For many small service businesses, yes. A plumber, salon or dental clinic usually needs pages, a contact or booking form, reviews and a way to edit content. A custom-coded site can do all of that without third-party plugins, so there is no plugin update queue and no plugin marketplace for attackers to study.

WordPress still makes sense when you need a large content library, many editors or a specific plugin ecosystem. The honest comparison is in our WordPress vs custom website guide. Either way, a site still needs hosting security, backups and someone responsible for maintenance.

How ITCM handles plugin risk

ITCM has cleaned and hardened hacked WordPress sites, including removing malicious code, cutting unneeded plugins and improving speed and security, as described in the WordPress recovery case study. For new projects, ITCM builds custom-coded sites, so there is no plugin sprawl to maintain.

The process is demo-first: ITCM builds your website and installable app before you pay, you see it finished, and you pay $150 one-time only if you are happy. That covers the website, installable app (PWA), 24/7 online booking, lead management, admin panel and 3 design options. Anything extra gets a fixed quote before work begins, and an optional care plan starts from $100/month.

Monthly WordPress plugin security checklist

Back up files and database, with a copy stored off the server.
Apply pending plugin, theme and core updates, then test key pages and forms.
Delete deactivated plugins and unused themes.
Replace any plugin not tested with the last 3 WordPress releases.
Confirm no nulled or unofficial plugin files are installed.
Review admin users and enforce strong passwords and two-factor login via a trusted plugin.
Re-run a security scan and check HTTPS and security headers.

Frequently asked questions

Are WordPress plugins safe to use?: Most are, when they come from reputable developers and are kept updated. The risk comes from outdated versions, abandoned plugins and pirated copies. Choose plugins with recent updates and active support, install as few as you need, delete what you do not use, and apply updates promptly with a backup in place. Safety depends far more on maintenance habits than on WordPress itself.
How do I know if a WordPress plugin is abandoned?: On its WordPress.org page, look for a warning that it has not been tested with the latest 3 major WordPress releases, a last-updated date long in the past, or support questions left unanswered. A red notice means the plugin has been closed. Any of these signs means you should plan to replace it with a maintained alternative before a new flaw appears.
What is a nulled plugin?: A nulled plugin is a pirated copy of a paid plugin with its licence check removed, usually shared on unofficial download sites. These copies often carry hidden code such as backdoors, spam links or redirects, and they never receive official security updates. Using one also breaks the developer's licence terms. If you find one on your site, delete it, scan for malware and change your passwords.
Should I turn on automatic plugin updates?: For small, well-maintained plugins, automatic updates are usually a good idea because security fixes arrive within hours. For large plugins such as page builders or e-commerce tools, many owners prefer to update manually after a backup, or test on a staging copy first. Whatever you choose, make sure someone checks the site after updates so a broken form is noticed quickly.
Does WordPress core have two-factor authentication?: No. WordPress core does not include built-in two-factor login, so you need a trusted security or 2FA plugin to add it. Two-factor authentication is one of the most effective protections for admin accounts, because a stolen password alone is no longer enough to log in. Apply it to every account with administrator or editor rights.
Is a security plugin enough to protect my site?: A security plugin helps with scanning, login protection and firewall rules, but it does not replace updates, backups or removing risky plugins. It is one layer. You still need current software, strong passwords with two-factor login, an off-server backup and someone who reviews alerts. A security plugin that nobody checks gives a false sense of safety.
When should I get professional help?: Get help if your site has been flagged by Google, shows redirects or spam pages, has unknown admin users, or if you do not have time for monthly updates. Professional help is also worth it before major changes such as a theme switch or moving hosts. A maintenance plan costs less than repeated cleanups and lost leads while the site is down.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles