Joomla vs WordPress Vulnerabilities: A Comparative Analysis and Statistics

• Popularity of Joomla and WordPress.
• Vulnerability statistics.
• A security level and vulnerability comparison for WordPress and Joomla websites.
• Joomla vs WordPress: vulnerabilities, hacks, and popularity.
• Potential reasons for the increase in hacks.
• Data sources for vulnerabilities.

I have been involved in website development since approximately 2008, and have worked specifically with Joomla since 2010. I use this CMS for almost all my projects, and I also maintain several personal websites built on it. From 2010 through May 2026, I have periodically received orders to restore websites after they were hacked. I have also frequently provided services for hardening sites against attacks. My personal website, Aleksius.com, has been hacked only once since its inception in January 2011.

In June and July 2026, I updated and configured security for more than 60 Joomla-based websites. About a third to a half of them had already been compromised. Importantly, these hacks were not related to the Joomla core, but rather to extensions from third-party developers. I have never encountered such a high volume of hacked sites in such a short period in my entire career. Notifications about discovered vulnerabilities and new versions with security patches began appearing for many popular Joomla extensions, such as JCE, Helix Ultimate, Helix 3, SP Page Builder, and others.

In this article, I analyze the current situation regarding the dynamics of discovered vulnerabilities and website hacks on Joomla, and compare it with WordPress. In short, the explosive growth in the number of hacks is likely due to automated AI-driven vulnerability scanning systems. This is relevant for both Joomla and WordPress. Most hacks are primarily linked to vulnerabilities in third-party extensions and plugins, rather than the core CMS themselves. A second significant factor is the lack of regular maintenance, updates, and neglect of basic website security best practices.

This article was written on August 02, 2026. The information provided should not be considered 100% accurate or exhaustive. The conclusions in this article reflect my own opinion and should not be taken as a guide for drastic actions.

Popularity of Joomla and WordPress

To better understand the situation regarding discovered vulnerabilities, it is necessary to compare the popularity of Joomla and WordPress.

The most accurate and comprehensive statistics regarding market share as a percentage of all websites on the internet are collected by the analytical company W3Techs. This platform has been tracking this data systematically since 2011. Additionally, data from Technologychecker.io can be used as a benchmark for both Joomla and WordPress. For a deeper analysis of their popularity, several other sources were used as well:

• «Historical yearly trends in the usage statistics of content management systems».
• «CMS Market Share 2026: Statistics, Trends and Analysis».
• «Leadership interview & Market share history».
• «CMS Market Share 2026: 80+ Statistics, Trends & Data».
• «WordPress Market Share Statistics (2011-2026)».
• «WordPress Statistics 2026: Usage, Market Share & Key Data».
• «80+ WordPress Statistics and Market Share Trends for 2026».
• «WordPress.org: Our Journey to Powering 40% of the Web».
• WordPress History. 

The generalized data is presented in the table below.

The chart below shows a comparison of the market share dynamics.

Vulnerability statistics

As input data for the analysis, I used vulnerability statistics from Nvd.nist.gov. I filtered the data containing the keywords «Joomla» and «WordPress» up to July 31, 2026. Further down in the article, there are some explanations regarding the authority of this source and the data it provides.

The tables below show the number of vulnerabilities found (not to be confused with actual hacks) in extensions/plugins for Joomla and WordPress by year. The data for 2026 is provided through July 31 inclusive.

Let's represent this data on charts (images below).

The charts show that in just the first 7 months of 2026, the number of discovered vulnerabilities is approaching peak historical levels for both CMS platforms over 21 years of observation.

Below is a chart comparing the number of vulnerabilities for both systems.

Let's examine the data for 2026 (from January to July inclusive) in more detail. For Joomla, vulnerabilities were found in 51 extensions.

For WordPress, vulnerabilities were found in 713 plugins.

I will present this information in the form of charts in the figures below.

As we can see, in July, for both systems, significantly more extensions/plugins were found with vulnerabilities than in previous months. This is especially noticeable for Joomla.

Conclusions. As of July 31, 2026, we have the following data for Joomla and WordPress (WP):

• Joomla market share (of all sites) in 2026: 1.3%.
• WordPress market share (of all sites) in 2026: 41.6%.
• Number of vulnerabilities found in Joomla extensions in 2026 (up to July inclusive): 174.
• Number of vulnerabilities found in WordPress plugins in 2026 (up to July inclusive): 2,985.
• Number of Joomla extensions with discovered vulnerabilities in 2026: 51.
• Number of WordPress plugins with discovered vulnerabilities in 2026: 713.
• Total number of Joomla extensions in the official extension directory: 4,848.
• Total number of WordPress plugins in the official plugin directory: 68,000.

If we convert absolute figures into relative metrics, a very interesting and somewhat unexpected picture emerges. For clarity, let's summarize the data and calculated coefficients in a table.

Despite the huge difference in absolute numbers (713 problematic plugins vs. 51), the percentage of plugins/extensions in which vulnerabilities were found is absolutely identical for both CMSs – about 1.05%. This means that the probability of encountering a vulnerable plugin in a random sample from the official directory is the same for both WordPress and Joomla.

The fact that 2,985 vulnerabilities were found for WordPress and only 174 for Joomla is explained solely by the size of the ecosystem. The WordPress catalog is 14 times larger than the Joomla catalog, and the number of discovered vulnerable plugins is also exactly 14 times larger.

On average, one vulnerable Joomla extension accounts for 3.41 vulnerabilities, while a WordPress plugin accounts for 4.19. This can be explained by the fact that WordPress's market share (41.6%) makes it an extremely attractive target. Security researchers and attackers spend more time deeply auditing the code of popular WordPress plugins, finding multiple flaws in a single problematic product at once.

From the perspective of website development and maintenance, the statistics debunk the myth that «WordPress plugins are worse/more dangerous by nature». At the level of the average developer, the code quality in the official directories of both systems is proportional. However, due to total market dominance, WordPress sites more frequently become targets of mass automated attacks, which requires a stricter approach to update monitoring.

Analyzing these data more deeply, several non-obvious but very important conclusions can be drawn regarding security, especially in the context of website development and maintenance.

Vulnerabilities scale by catalog size, not market share. This is one of the most interesting paradoxes of these data:

• The WordPress market share (41.6%) is larger than Joomla's (1.3%) by 32 times.
• But the number of discovered vulnerabilities (2,985 vs. 174) is larger by only 17 times.
• And the number of vulnerable plugins (713 vs. 51) is larger by 14 times, which perfectly matches the difference in their catalog sizes (68,000 vs. 4,848).

The level of security is determined not by how popular the CMS is among users (market share), but by how «bloated» its extension catalog is. Developers make approximately the same number of errors in the code, regardless of whether they write for Joomla or WordPress.

A radical difference in operational workload for site maintenance. If we break this data down over time (for the 7 months of 2026), we get a picture of the real workload for a webmaster providing technical support services:

• 2,985 vulnerabilities over 7 months is approximately 426 vulnerabilities per month, or about 14 every day.
• 174 vulnerabilities over 7 months is about 25 per month, or less than 1 per day.

Technical support for WordPress sites requires much more aggressive monitoring. For WP, it is critically important to have automated vulnerability tracking systems and daily backup/update routines, as new flaws appear by the dozens every day. Joomla maintenance is significantly «calmer» in this regard.

The illusion of «long tail» security (99% untested code). According to the provided data, vulnerabilities were found in only 1.05% of plugins in both systems. That means:

• About 4,797 extensions remain in Joomla where no vulnerabilities were found.
• About 67,287 plugins remain in WordPress where no vulnerabilities were found.

This does not mean that 99% of plugins are perfectly secure. It means that security researchers (both «white hat» and hackers) focus their efforts on top, most popular plugins. A huge mass of plugins (the so-called «long tail») remains outside the attention of auditors. Using a little-known or abandoned extension carries a major hidden risk in both CMSs, as its code simply has not been professionally tested for exploits.

Exploitation profitability (hacker economics). Based on the ratio of 174 vulnerabilities to 1.3% market share (Joomla) versus 2,985 to 41.6% (WordPress), we can evaluate the commercial attractiveness of finding flaws. Finding a vulnerability in a popular WordPress plugin means getting potential access to millions of sites that can be combined into a botnet, used for SEO spam, or phishing campaigns. The WordPress ecosystem is under constant, systematic, and highly professional pressure from attackers due to the high return on investment (ROI) of breaches. Joomla vulnerabilities are searched for less frequently because a smaller audience makes mass automated attacks less financially profitable. For Joomla, a greater threat comes from targeted attacks on a specific site rather than mass scans as seen with WP.

A security level and vulnerability comparison for WordPress and Joomla websites

If evaluated purely mathematically, based on the statistics provided in the article above, 1.05% of extensions in both catalogs are vulnerable, meaning the probability of installing a problematic plugin seems identical. However, under real operating conditions, the probability that an average WordPress site will turn out to be more vulnerable (and get hacked) is higher than a Joomla site. This is not because the WordPress core is poorly written. It is a consequence of architectural features, market realities, and attacker behavior. Here is why this happens.

Attack surface (number of installed extensions/plugins). Historically, Joomla has a richer out-of-the-box functionality. Many things – such as multilingual support, complex access control lists (ACL), basic SEO settings, the ability to send emails from the site (including contact forms), or custom fields – are already built into the core.

WordPress has a philosophy of a minimalist core. To get a fully functional modern site, a developer has to install plugins for SEO, caching, multilingual support, email delivery, feedback forms, and so on.

If the probability of encountering vulnerable code is approximately 1%, a Joomla site with 3rd-party extensions has a smaller attack surface than a WordPress site with 25-30 plugins. More 3rd-party code means a higher risk.

Probability of a «blind» attack. A vulnerability only exists when someone tries to exploit it. Due to its 41.6% market share, WordPress is the de facto standard for automated hacker scanners.

• Bots constantly and massively scan the internet, checking standard paths (for example, «/wp-content/plugins/known-vulnerable-plugin/»).
• The probability that a newly published vulnerability in a WP plugin will be attempted on your site within the first 24 hours approaches 100%.
• Joomla sites are scanned much less frequently. A vulnerability can exist there for months before automated scripts get around to it.

Rate of «technical aging» (Decay rate). Assuming the situation develops similarly to what we calculated earlier, about 14 new vulnerabilities appear for WP daily in 2026, and less than one for Joomla. If a client site is left unattended and un-updated for three months:

• One can assume that over that time, more than 1,200 new attack vectors will appear worldwide for a WP site, and bots will actively search for them.
• About 75 new vectors will appear for a Joomla site, and they will be searched for less intensively.
• Without regular maintenance, a WordPress site turns into a «sieve» many times faster.

Making such an assumption is overly reckless, plus making linear extrapolation based on just 1-2 months of observation is incorrect, but the general principle is clear.

Interconnection of extensions. In WordPress, plugins frequently interact heavily with one another (for example, add-ons for Elementor or payment gateways for WooCommerce). A vulnerability in a small add-on can open a path to manipulating data in the main, reliable plugin. In Joomla, components and modules are generally more isolated from each other within the MVC architecture.

Summary. The probability of a breach is determined not so much by the choice of CMS, but by the presence of systematic technical maintenance. Without support, WordPress is far more vulnerable. An abandoned WP site will likely be infected with malware or turned into part of a botnet within a few months. Joomla will hold out longer purely due to lower hacker attention (though Joomla sites still require the support of a specialist). With professional support, both systems are secure. If a developer constantly monitors status, patches holes in a timely manner, updates plugins, and configures a WAF (Web Application Firewall), the risk of a breach for both WP and Joomla is minimized. The mass adoption of WordPress makes regular technical support not just an option, but a critical necessity for any business. This statement is also true for Joomla sites (though to a lesser extent).

Joomla vs WordPress: vulnerabilities, hacks, and popularity

Based on the previously provided data regarding the popularity of the systems and the number of vulnerabilities found in them by year, I will present several conclusions. I will take data starting from 2014 (because information on market shares could not be found for previous years) through July 2026 inclusive.

Data analysis allows us to draw several interesting conclusions regarding the relationship between the popularity of content management systems (CMS) and the number of vulnerabilities found in their extensions.

Direct, but non-proportional dependence for WordPress. WordPress is the absolute market leader, which logically makes it the main target for hackers and cybersecurity researchers. However, the growth in the number of vulnerabilities significantly outpaces the growth in market share. The market share of WordPress from 2014 to 2024 grew approximately 2 times (from 21% to 43.6%). The number of discovered vulnerabilities over the same period increased by almost 14 times (from 326 to 4,484). This indicates that the WordPress plugin ecosystem has grown to massive proportions, and the code quality of many third-party developers remains low. In addition, automated vulnerability discovery tools (scanners) have become much more efficient.

Colossal disparity between systems (WordPress vs. Joomla). If we compare the ratio of market shares with the ratio of the number of vulnerabilities, we see a huge gap. In 2024, the market share of WordPress (43.6%) was larger than Joomla's (1.7%) by about 25 times. But the number of WordPress plugin vulnerabilities (4,484) exceeded Joomla's vulnerabilities (12) by 373 times. In 2025, this ratio is about 27 times for market share and about 90 times for the number of vulnerabilities. Security researchers and attackers focus almost all their attention on WordPress, because exploiting a vulnerability there yields a much higher «return on investment» (ROI) in the form of millions of potential victims. Joomla often simply remains outside their primary focus.

Decline in market share does not guarantee a decrease in vulnerabilities (The 2026 Joomla Anomaly). Joomla demonstrates a decline in popularity (from 3.4% in 2017 to 1.3% in 2026). It might seem that hacker interest in it should also fade. Until 2025, the figures were relatively low and unstable. However, in 2026 (in just 7 months), 174 vulnerabilities have already been found – an absolute record for Joomla over the entire presented period, despite the fact that its market share dropped to 1.3%. Such a sharp surge usually indicates not a sudden popularity of the CMS, but the fact that some team of «researchers» (or an automated tool) purposefully scanned the Joomla extension catalog and found a systemic error that had been present for years in many old or abandoned modules.

There is no linear relationship between market share and the number of vulnerabilities. The number of discovered security holes depends not so much on the percentage of sites on the global network, but on:

1. The size of the ecosystem (the number of available plugins).
2. The financial motivation of security researchers and hackers (the higher the market share, the more profitable it is to look for vulnerabilities).
3. Sudden targeted security audits that can lead to record numbers of found errors even in a CMS with lower popularity (Joomla in 2026).

Analyzing the data more deeply, we can highlight a few more non-obvious, but important trends concerning the development of the cybersecurity industry and the lifecycle of the CMSs themselves.

Systematicity (WordPress) vs. Sporadicity (Joomla). The dynamics of vulnerability discovery in these two systems have fundamentally different natures. In WordPress, we see a clear, almost exponential trend towards an increase in the number of discovered vulnerabilities (starting from 2021). This indicates a systematic approach: the ecosystem is continuously scanned by powerful automated tools and commercial cybersecurity companies. In Joomla, the dynamics are chaotic (for example: 2018 – 109, 2022 – 16, 2026 – 174). The absence of a trend indicates that the system is not massively monitored 24/7. Surges occur only when individual «enthusiasts» or small groups of researchers decide to conduct a manual audit of old extensions.

The effect of vulnerability discovery commercialization (Bug Bounty). WordPress data perfectly illustrates the evolution of the bug-hunting industry itself (Bug Bounty), and not just the deterioration of code quality. From 2020 to 2024, the WordPress market share grew by less than a quarter (from 35.4% to 43.6%). Over the same time, the number of discovered vulnerabilities increased more than 16 times (from 272 to 4,484). Such a jump is explained by the appearance of specialized platforms (such as Patchstack or Wordfence Bug Bounty) that began paying researchers real money for discovered holes in plugins. As a result, finding vulnerabilities in WordPress has turned into a profitable business, which has generated a huge stream of reports.

Market stagnation does not stop hackers. According to the data provided earlier in the article, in 2026 the WordPress market share began to fall for the first time in a long time (from 43.6% to 41.6%). However, the number of vulnerabilities remains at a record high level. As of July 2026, 2,985 vulnerabilities have already been found. If we extrapolate this figure to the entire year, the indicator may exceed 5,000. This means that the base of existing, outdated code in the plugin catalog is so large that security researchers and hackers will find vulnerabilities there for many years to come, even if the CMS itself stops attracting new users.

«Risk density» (the number of discovered vulnerabilities per 1% of market share) for both systems over the selected period.

The «era» of parity (2015–2016). In these years, «risk density» was practically identical, and in 2016 WordPress was even proportionally safer than Joomla (3.0 vs. 4.2). This was a time before the mass commercialization of bug hunting.

The WordPress turning point (starting from 2022). It is from 2022 that the WordPress density index begins to grow rapidly (from 38.4 to a peak of 102.8 in 2024). The plugin ecosystem reached critical mass, turning vulnerability discovery into a streamlined industry.

The wave-like nature of Joomla. The Joomla metric jumps sharply (2018, 2025, 2026), which confirms the theory of sporadic, targeted audits.

The 2026 anomaly. This table makes the 2026 «phenomenon» even more apparent. Despite the fact that the year is not yet over (data is provided up to July 2026), Joomla's risk density has already reached 133.8, surpassing even WordPress's worst historical figures. Since Joomla's market share is 1.3%, each discovered vulnerability mathematically hits this index much harder.

Potential reasons for the increase in hacks

Let's consider possible reasons why, starting from June 2026, there began a significant increase in discovered vulnerabilities in Joomla extensions and WordPress plugins (compared to the beginning of 2026)?

The significant increase in the number of discovered vulnerabilities in Joomla extensions and WordPress plugins in June-July 2026 is driven by a combination of new code-scanning technologies and a series of massive cyberattacks. Here are several possible reasons why the statistical spike occurred precisely during this period.

Launch of autonomous AI agents for threat hunting. The automation of cybersecurity processes using artificial intelligence had the biggest impact on the number of detected vulnerabilities. In the summer of 2026, companies began deploying autonomous AI threat analysis agents (such as Wordfence PRISM). Such systems are capable of continuously analyzing plugin code and finding backdoors or architectural flaws just a few hours after they appear in official repositories. This dramatically increased the speed and scale of detection: AI-powered tools allowed researchers to report hundreds of new vulnerabilities every week, generating a huge statistical spike compared to the beginning of the year, when audits were mostly performed manually.

Claude Mythos. Claude Mythos is a class of large language models from Anthropic designed specifically for cybersecurity and deep code analysis for bugs. On June 9, 2026, two versions were released: the closed Claude Mythos 5 (available exclusively to verified partners) and the public Claude Fable 5. Hackers could use these models to search for vulnerabilities. This is supported by several facts.

• Rapid bypassing of defense mechanisms (Jailbreaking). Although the public Fable 5 model has special filters that block requests related to hacking (in such cases, the model switches to the weaker Claude Opus 4.8), cybersecurity researchers reported successful circumvention of these limitations as early as mid-June 2026. Using sophisticated context manipulations, attackers can bypass barriers and force Fable 5 to search for vulnerabilities at the level of the closed Mythos 5. Source.
• Exploitation of «zero-day» in practice. Security reports indicate that the gaps found during this period were instantly exploited by attackers. For instance, among critical vulnerabilities with the maximum CVSS score of 10.0 discovered in Joomla extensions (such as Balbooa Forms, iCagenda, PageBuilder CK), several were exploited by hackers «in the wild» as zero-day vulnerabilities even before patches were released. Source.
• An ideal target. 96% of all WordPress vulnerabilities reside specifically in plugins. The open-source code of thousands of WordPress plugins and Joomla extensions is ideal material for analysis by such tools, as they often use simple and predictable code patterns. Source.

Therefore, Anthropic models could be the reason for the June vulnerability surge. Here are several grounds to think so.

• Ideal chronological match. The models were launched on June 9, 2026. An unprecedented surge began immediately after. In just one week (from June 29 to July 5), Wordfence recorded 250 new vulnerabilities across 181 WordPress plugins and 41 themes. In the Joomla system, between mid-June and the end of July, independent researchers discovered 19 vulnerabilities at once across 17 popular extensions (many of which allowed full access to databases and servers). Source.
• AI-level automation. Forrester analysts directly linked the release of Fable 5 to a «record number of CVEs», predicting a further increase in this metric. AI allows auditors and hackers to scan hundreds of lines of code at a speed previously physically unattainable for humans.
• US Government Intervention. The situation turned out to be so serious that the US Department of Commerce initiated export controls and temporarily suspended worldwide access to the Mythos 5 and Fable 5 models from June 12 to 30, 2026. The reason was national security concerns specifically regarding Fable 5 jailbreak methods and automated vulnerability hunting. Source.

Today, ultra-powerful code analysis tools (such as Claude Mythos 5 and the recently released competing model from OpenAI, GPT-5.5-Cyber) have fallen into the hands of both security researchers ("white hat hackers") who report these vulnerabilities to developers, and malicious actors. This symbiosis of automation and AI accessibility created an unprecedented wave of vulnerability discoveries in CMS platforms.

An epidemic of critical 0-day vulnerabilities in popular extensions. In June 2026, several extremely serious vulnerabilities were disclosed, which provoked a wave of massive automated attacks and drew increased auditor attention to CMS platforms:

• CVE-2026-48907 (Joomla Content Editor - JCE): A critical vulnerability with the maximum severity score (CVSS 10.0) in one of the most popular Joomla extensions. It allowed any unauthorized user to upload PHP files and remotely execute code on the server. CISA urgently added it to the Known Exploited Vulnerabilities (KEV) catalog.
• CVE-2026-53776: A serious issue (CVSS 9.1) involving authorization bypass via JWT token manipulation, making it impossible to securely terminate user sessions.
• Simultaneously, mass exploitation of vulnerabilities in the LiteSpeed client plugin for cPanel was recorded, allowing hackers to gain root privileges on virtual hosting servers.

The «Vibe Coding» phenomenon and generative AI in development. Many plugin developers began actively using large language models (LLMs) to write new extension code or accelerate routine tasks («vibe coding»). Most often, developers – especially solo creators or small studios – do not have the time or sufficient qualifications to deeply verify AI-generated code before releasing it into production.

Ecosystem expansion and supply chain complexity. Both WordPress and Joomla have long outgrown simple blogging engines into complex enterprise-level ecosystems. A vulnerability in a single base microframework (upon which an entire line of plugins from a single developer is built) automatically compromises all child extensions.

Growth of bug bounty programs. The popularity of platforms like Patchstack, Wordfence Bug Bounty Program, and specialized security monitoring services for Joomla (such as mySites.guru) led to financial rewards being paid for discovered bugs. This stimulated entire communities of ethical hackers to professionally and massively research plugins for vulnerabilities, which naturally reflects on publication statistics.

Regulatory pressure (e.g., EU Cyber Resilience Act). The introduction of new cybersecurity standards in several regions (specifically, the European Cyber Resilience Act) forces software developers to approach security audits strictly and mandates public vulnerability reporting. What used to be hushed up or fixed «quietly» is now officially registered and published.

Data sources for vulnerabilities

As the source of breach data on which the entire article is based, the website Nvd.nist.gov was used.

NVD (National Vulnerability Database) is the National Vulnerability Database maintained by the US government. It is managed by NIST (National Institute of Standards and Technology), an authoritative government laboratory dedicated to the development of standards and technology.

It is worth making an important technical clarification right away. The NVD website (National Vulnerability Database), maintained by the US National Institute of Standards and Technology (NIST), does not record actual successful website hacks (incidents), but rather systematized information about discovered vulnerabilities in software.

For each registered code flaw, NVD provides an expanded technical dossier:

• CVE Identifier (Common Vulnerabilities and Exposures). A unique international vulnerability number (e.g., CVE-2023-XXXX).
• CVSS Criticality Score (0.0 – 10.0). An indicator of how easy it is to exploit a security hole and what consequences it can cause (low, medium, high, or critical level).
• Error Type by CWE Classification (Common Weakness Enumeration). Indicates the exact nature of the problem (e.g., SQL injection, Cross-Site Scripting (XSS), Remote Code Execution (RCE), etc.).
• Specification by CPE Standards (Common Platform Enumeration). An exact list of programs and versions that contain this vulnerability (e.g., Joomla! 4.0.0 - 4.2.7 or WordPress Core 6.1.x).
• Descriptions and Official Links. Links to patches with fixes, official developer bulletins, and security researcher reports.

NVD is considered the «gold standard» in cybersecurity due to several factors.

• Independence and Absence of Commercial Interest: NIST is a US government agency. The NVD database is government-funded and independent of marketing campaigns or competition between CMS developers. It has no interest in promoting or lowering the ratings of Joomla or WordPress.
• Unified Evaluation Methodology. NVD applies a standardized CVSS system to any software. This allows comparing the potential risk of a vulnerability in the Joomla core with a similar vulnerability in WordPress using absolute identical criteria.
• Data Verification from Multiple Sources. Information comes from authorized registration centers (CNA – CVE Numbering Authorities), which include both official security teams (Joomla Security Task Force, WordPress Security Team) and independent cybersecurity analytical companies. NVD verifies and analyzes each submission before publication.

For the comparison to be correct, it is important to consider several nuances of interpreting NVD data:

Gemini 3.1 Pro (Expanded thinking) was used in writing the article for source discovery, text translation, sentence reformulation, spell checking, calculations, and building a list of unique extensions/plugins with discovered vulnerabilities.

Article author – Aleksej Khoroshevskij

Ph.D., lecturer at Kharkiv National University of Radio Electronics, web developer, and SEO specialist with over 15 years of experience. Expert in website creation using Joomla and WebSite X5. Author of scientific publications, video courses, and educational content on web development and SEO. Runs a blog and a YouTube channel, sharing knowledge and practical experience. Provides services in website development, customization, maintenance, and promotion. Learn more about the author… Contacts: +38 095 840 24 29 +38 095 840 24 29 +38 095 840 24 29 email@aleksius.com Social networks: LinkedIn Facebook YouTube (Twitter) Publications and work: Google Scholar Scopus Upwork Freelance.ua