Many WordPress vulnerabilities can be attributed to one of three categories. According to a recent WordPress vulnerability report, 97% of vulnerabilities come from WordPress plugins, 2.4% from themes, and only 0.05% from the core software.