In 2026, several WordPress plugins installed on millions of sites had serious cybersecurity vulnerabilities, and WordPress core itself shipped six security updates between July and October 2026. This post covers four major plugin vulnerabilities, the core security fixes released between those core security fixes, and practical steps to reduce risk. Plus, you will get a look at when managed WordPress hosting makes sense for agencies.