Is WordPress secure?

WordPress core is reasonably secure when kept updated, but the ecosystem of plugins and themes introduces significant risk. WordPress powers over 40% of the web, making it the most targeted CMS by attackers. The majority of WordPress vulnerabilities come from third-party plugins, which may have SQL injection, cross-site scripting, or remote code execution flaws. Outdated WordPress installations, plugins, and themes are the primary attack vector. Default configurations like the wp-admin login page and XML-RPC endpoint are frequently targeted. UNPWNED scans WordPress sites for known vulnerabilities, exposed admin panels, outdated components, and security misconfigurations.