Of 2,108 EU WordPress sites where we could read a component version, 1,271 (60.3%) run at least one plugin or theme in a version with a publicly known vulnerability. This measures patch hygiene — not that a site is exploitable.
Analysis of live, content-validated websites · vulnerability data from Wordfence Intelligence · snapshot 2026-07-25 · by Piperic
Share of measured WordPress sites running a known-vulnerable component — lower = more up-to-date. EU ranks #21 of 37 countries.
Neighbours shown for context. Full ranking in the data download.
EU's WordPress web measured against the global average — and its exposure to an end-of-life front-end library that stopped receiving security fixes in 2016.
Share of measured EU WordPress sites running each plugin or theme in a version with a known vulnerability.
Among EU sites that run each of these popular components, the share on a version with a known vulnerability. Some stay current; page-builders and sliders lag.
Of EU sites running a vulnerable component, the worst-case severity (CVSS) present.
Free, no signup — see what our index knows about any site:
How to cite: “According to Piperic's WordPress Security Report (2026-07-25), 60.3% of measured EU WordPress sites run a component with a known vulnerability…” — link to this page.
Download the country dataset (JSON) Global rankings dataset
Sample: measured EU WordPress sites (ccTLD-based assignment) where at least one plugin/theme version was readable from the homepage. Plugin/theme versions are cross-referenced against the Wordfence Intelligence vulnerability database (CVE-anchored). This measures update hygiene — running a version for which a vulnerability was disclosed — not exploitability. Homepage-only detection sees front-end components, not back-end plugins. All figures are aggregate; no individual site is identified. Snapshot 2026-07-25 (frozen). Vulnerability data © Wordfence Intelligence, MITRE where applicable.
Press contact: press@piperic.com · Data: Piperic Business Intelligence
Every number on this page is reproducible from the public dataset above.