Can WordPress plugins be hacked?

WordPress plugins are the leading source of WordPress security breaches. Thousands of plugin vulnerabilities are discovered annually, ranging from minor information disclosure to critical remote code execution. Plugins run with full WordPress privileges, so a single vulnerable plugin can compromise your entire site. Supply chain attacks have occurred where popular plugins were acquired by malicious actors who pushed backdoored updates. Abandoned plugins that no longer receive security patches remain installed on millions of sites. Only use plugins from reputable developers with active maintenance, and remove any plugins you are not actively using. UNPWNED checks known published CVE signals for detected components and publicly exposed plugin indicators; it does not inspect plugin source code.