Of 20,132 Germany WordPress sites where we could read a component version, 10,952 (54.4%) run at least one plugin or theme in a version with a publicly known vulnerability. This measures patch hygiene — not that a site is exploitable.
Analysis of live, content-validated websites · vulnerability data from Wordfence Intelligence · snapshot 2026-07-25 · by Piperic
Share of measured WordPress sites running a known-vulnerable component — lower = more up-to-date. Germany ranks #30 of 37 countries.
Neighbours shown for context. Full ranking in the data download.
Germany's WordPress web measured against the global average — and its exposure to an end-of-life front-end library that stopped receiving security fixes in 2016.
Share of measured Germany WordPress sites running each plugin or theme in a version with a known vulnerability.
Among Germany sites that run each of these popular components, the share on a version with a known vulnerability. Some stay current; page-builders and sliders lag.
Of Germany sites running a vulnerable component, the worst-case severity (CVSS) present.
Share of measured Germany WordPress sites with a known-vulnerable component, by industry.
| Sector | Sites | Vulnerable |
|---|---|---|
| Shopping | 261 | 73.9% |
| Automotive | 200 | 60.5% |
| Travel | 332 | 58.7% |
| Medical Health | 150 | 57.3% |
| Technology And Computing | 342 | 56.7% |
| Business And Finance | 290 | 55.2% |
| Real Estate | 335 | 54.0% |
| Law | 146 | 50.7% |
| Adult Content | 201 | 49.8% |
| Entertainment | 128 | 49.2% |
| Attractions | 200 | 46.5% |
Free, no signup — see what our index knows about any site:
How to cite: “According to Piperic's WordPress Security Report (2026-07-25), 54.4% of measured Germany WordPress sites run a component with a known vulnerability…” — link to this page.
Download the country dataset (JSON) Global rankings dataset
Sample: measured Germany WordPress sites (ccTLD-based assignment) where at least one plugin/theme version was readable from the homepage. Plugin/theme versions are cross-referenced against the Wordfence Intelligence vulnerability database (CVE-anchored). This measures update hygiene — running a version for which a vulnerability was disclosed — not exploitability. Homepage-only detection sees front-end components, not back-end plugins. All figures are aggregate; no individual site is identified. Snapshot 2026-07-25 (frozen). Vulnerability data © Wordfence Intelligence, MITRE where applicable.
Press contact: press@piperic.com · Data: Piperic Business Intelligence
Every number on this page is reproducible from the public dataset above.