WordPress Security Scan blog.wpscan.org

The main problem with WordPress when it comes to security is its third-party plugins. These plugins can be developed by anyone with varying degrees of security experience and uploaded to the official WordPress plugin repository. The plugins are verified by a team at WordPress when initially uploaded, but it is not known to what extent the plugins are checked for security issues. And once the plugin has been approved, the developer is free to make any future changes without any verifications. This can lead to developers introducing security vulnerabilities later on in subsequent updates to the plugin.