Patchstack: 91% of 2025 WordPress vulnerabilities were in plugins, not core

·4 views

A Patchstack 2026 report found that 91% of WordPress vulnerabilities disclosed in 2025 were in plugins, with only six in core software. The article offers a command-line method for auditing plugins using WP-CLI and curl, including checking for exposed readme files that reveal version numbers. It recommends checking plugin update dates, querying vulnerability databases such as WPScan, and comparing installed versions against fixed versions. It also notes that many 2025 flaws had no patch at disclosure, and suggests removing unused plugins or restricting access at the server level.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 87,094-line C++ GUI toolkit with no third-party dependencies

A developer has released Zekit, a self-contained C++20 desktop GUI toolkit for Windows and Linux that bundles window creation, the message loop, GPU rendering, widgets, layout, text, and IME into one static library. Its 87,094 lines of code render through three backends on Windows (D3D12, Vulkan, OpenGL) and two on Linux (EGL OpenGL, Vulkan), with X11 supported but Wayland not yet. The author reports that fewer than 7% of the code touches the GPU, with most effort going into widgets, layout, and platform-specific window and input handling. macOS, iOS, Android, and HarmonyOS source exists in the tree but is not offered as a working target. The project is MIT licensed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a passing npm build doesn't prove AI-generated frontend code works

The author argues that AI coding agents can make a build succeed while still shipping frontends that break in real browsers. Compilers cannot detect runtime problems such as hydration mismatches, mobile overflow, undersized touch targets, dark-mode readability issues, or silent API failures. The author also points to generic 'AI slop' design defaults that make pages look interchangeable. To address this, the author maintains open-source tools, including ghost-qa, which runs headless Chromium against a dev server across multiple viewports and color schemes. The tool checks for runtime, layout, accessibility, performance, and SEO issues and produces a scored report with actionable output for agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What a Marketing Mix Model Is and Whether Your Team Needs One

Marketing teams facing budget questions often find that last-touch reports and self-reported surveys cannot show which spending actually works. A marketing mix model answers this by using weekly spend per channel and outcomes such as sign-ups, splitting results into a baseline and the portion driven by media. The method works from aggregated totals rather than individual users, so it needs no personal data and can weigh offline channels alongside online ones. It is typically built on around three years of weekly history, and open-source tools from Google and PyMC Labs have lowered the software cost. The article argues that AI-assistant influence, which has no spend line, will need separate measurement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Author Logs 10,926 Sites Hunting Free Backlinks; Only 15 Links Stay Live

Between 20 October and 12 November 2026, a developer trying to earn free backlinks for a small B2B software site kept a log of 10,926 candidate domains and rejected each one with a recorded reason. Only 15 domains carried a live, followed link on a publicly indexable page when re-checked on 12 November, and the most common rejection reasons were nofollow attributes, noindex tags, reciprocal-link requirements, paid-only or long-queue access, and dead sites. The author also tested a paid press release service, finding its sample links were nofollow and the page was marked noindex. Most of the surviving links came from software directories and a few came from articles the author wrote for newsletters and community blogs. The author noted that Google and Bing report different link counts and that it is not yet clear whether the remaining links will be counted.

0 comments Read more at DEV Community