Only 22% of H1 2025 Vulnerabilities Scored High or Critical CVSS

Only 22% of vulnerabilities logged in the first half of 2025 were rated High or Critical by CVSS. On paper, that sounds like relief. Fewer fires, fewer late nights, fewer emergency patches.

In practice, it creates a different problem: CVSS risk prioritization gets noisier when the “obvious” bucket is small. Most findings fall within the Medium and Low ranges, which encourages two expensive habits. First, teams over-triage and burn cycles, debating scoring nuance instead of reducing exposure. Second, teams under-react and let “not critical” become “not urgent,” even when the affected component is public-facing, widely used, and easy to probe.

CVSS is useful, but it is not a prioritization strategy. It is one input. What actually determines impact is context: where the vulnerable code runs, whether the site is reachable, what data is behind it, which plugins are business-critical, and how quickly attackers can chain a Medium into something operationally painful.

This is where WordPress environments get tricky. A vulnerability with a modest score can still matter if it sits inside a plugin that touches authentication, forms, file uploads, or integrations. If your team is using CVSS as the primary sorting mechanism, you are likely spending time on the wrong end of the list.

A better approach is to keep CVSS, but add decision-grade signals: asset criticality, internet exposure, compensating controls, and evidence of active exploitation. Then you can turn a long backlog into a short, defensible plan that leadership can understand and auditors can respect.

When only a small slice is High or Critical, the teams that win are the ones that add context fast. That means knowing what’s installed, what’s exposed, and what changed since yesterday. It also means catching the “Medium” issues that are easy to exploit in your environment. See what monitored coverage looks like for your WordPress stack.

Source: Patchstack, 2025 Mid-year Vulnerability Report