Is WordPress secure?

WordPress core is reasonably secure when kept updated, but the ecosystem of plugins and themes introduces significant risk. WordPress powers over 40% of the web, making it the most targeted CMS by attackers. The majority of WordPress vulnerabilities come from third-party plugins, which may have SQL injection, cross-site scripting, or remote code execution flaws. Outdated WordPress installations, plugins, and themes are the primary attack vector. Default configurations like the wp-admin login page and XML-RPC endpoint are frequently targeted. UNPWNED checks known published CVE signals for detected components plus externally observable admin-path, XML-RPC, exposure, header, dependency, and configuration signals.