One week of WordPress produced 249 new vulnerability records: 197 plugins and 2 themes, filed by 136 separate researchers, all covering August 3 to August 9. Thirteen of them are rated critical and 62 high. When we checked the tally on Thursday, 32 still had no patch available.
That last number is the only one that turns into work.
The figures come from the weekly report published by Wordfence's Chloe Chamberland, and they are worth reading as a rate rather than a headline. Nothing here is a single dramatic bug. It is the steady background pressure of an ecosystem where the platform is maintained tightly and the enormous catalogue of things bolted onto it is not, which is why compromised WordPress installs keep turning up as delivery infrastructure, as they did when hacked sites were used to push a stealer through the Deno runtime.
Core turns up in the rule list
The more interesting item this week is not in the statistics. Among the new firewall rules Wordfence deployed is one covering WordPress Core 7.0.2 and earlier, for an unauthenticated reflected cross-site scripting flaw reached through the log parameter. Reflected XSS means the malicious input travels in the request itself, so an attacker needs a target to follow a crafted link rather than simply hitting the site directly.
Beyond the affected version range and the parameter, the report does not publish a CVE identifier, a severity score or any detail about the impact, and we are not going to fill that gap by guessing. A second new rule, WAF-RULE-940, is explicitly redacted while Wordfence works with the vendor on a patch. A third covers an authentication bypass in a piece of malware, emer-run.php, which points at cleanup on already compromised sites rather than at a new disclosure. Wordfence's paying customers get all three immediately; sites on the free plugin receive them after 30 days.
What the bug classes say about the ecosystem
The breakdown by weakness type is unusually stable week to week. Cross-site scripting accounted for 79 of the 249, missing authorization for 54, and SQL injection for 31. Another 17 were authorization bypasses through a user controlled key, and 17 more exposed sensitive information to unauthorized users. Path traversal, cross-site request forgery and server-side request forgery filled out the tail with 10, 9 and 6.
Put together, roughly a third of the week is some form of a plugin failing to check whether the person making a request was allowed to make it. That is not an exotic failure mode, and it is the reason a single unmaintained plugin can undo an otherwise careful site, as the WPMU DEV dashboard bypass demonstrated earlier this month.
Patch the criticals, then chase the 32
The practical sequence is straightforward. Update everything that has an update, starting with the 13 critical entries. Then take an inventory of what remains: the flaws with no fix available are the ones that need a decision, whether that is disabling the plugin, restricting the affected functionality, or accepting the risk deliberately rather than by omission. Wordfence's vulnerability database and API are free to query, so there is no licensing reason to skip that step.
One detail from our own check is worth keeping in mind. The patched and unpatched counts on that report moved during the day we read it, as maintainers shipped fixes. A weekly vulnerability report is a snapshot of a moving surface, not a ledger, and the site you audited on Monday is a different risk on Friday. Two of the week's more consequential WordPress issues, including the XSS2Shell chain that ends in code execution, only became urgent once public exploit code caught up with the disclosure.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.