Updated October 2026. We counted 74,643 WordPress.org plugins. Last-updated date is useful context, not a security verdict on its own.
If you mainly care about installs, start with abandoned plugins still in use.
| No update in | Plugins | Share of directory |
|---|---|---|
| 1 year | 41,314 | 55.3% |
| 2 years | 35,493 | 47.6% |
| 3 years | 32,761 | 43.9% |
| 5 years | 28,205 | 37.8% |
| 8 years | 20,419 | 27.4% |
An old plugin is not automatically vulnerable. Quiet, finished code can go years without a release. A plugin updated last week can ship a critical bug the same day.
On a client book, what matters is the mix: long without a maintainer, still installed, handling input or payments, behind on PHP or WordPress, or already matching a known vulnerability. WP Triage ranks those signals per site. Details are in the scoring methodology. Unmaintained plugins show up next to CVEs and PHP end-of-life, then land in a fix order.
We sampled 5,050 plugins from the two-year abandoned tail (every 7th API page):
| Active installs | Share of sample | Count in sample |
|---|---|---|
| 1000+ | 2.9% | 144 |
| 100-999 | 11.8% | 595 |
| 10-99 | 58.5% | 2,954 |
| 0-9 | 26.9% | 1,357 |
Apply the 1,000+ share to the full abandoned set and you get roughly 1,012 plugins with no update in two years, each still on at least a thousand sites. For agencies, that figure is more useful than the directory percentage alone.
Fields below come straight from the WordPress.org API. We do not publish a risk score for each slug. That depends on the site that runs it.
| Plugin | Last updated | Active installs | Tested up to | Requires PHP | Version |
|---|---|---|---|---|---|
| BackUpWordPress | 2024-04-24 9:40am GMT | 80,000+ | 6.5.13 | - | 3.14 |
| WP Show Posts | 2024-04-16 7:12pm GMT | 70,000+ | 6.1.15 | - | 1.1.6 |
| Facebook Chat Plugin – Live Chat Plugin for WordPress | 2022-07-05 11:01pm GMT | 70,000+ | 5.9.19 | 5.2.4 | 2.5 |
| PHP Code Widget | 2022-03-30 4:55pm GMT | 70,000+ | 5.9.19 | - | 2.4 |
| Enhanced Media Library | 2024-07-15 2:07pm GMT | 60,000+ | 6.5.13 | 5.6 | 2.9.4 |
| Enhanced Text Widget | 2024-07-17 1:21am GMT | 30,000+ | 6.6.10 | - | 1.6.7 |
| Display PHP Version | 2023-05-16 5:30pm GMT | 30,000+ | 6.2.14 | - | 1.8 |
| My-Plugins | 2013-07-02 1:34pm GMT | 30,000+ | 3.5.2 | - | 0.3 |
| AccessibleWP – Accessibility Toolbar | 2024-10-03 8:04am GMT | 20,000+ | 6.6.10 | - | 5.4.0 |
| Mega Addons For WPBakery Page Builder | 2024-01-11 11:01pm GMT | 20,000+ | 6.2.14 | - | 4.3.0 |
| WP Maximum Execution Time Exceeded | 2021-01-25 4:11am GMT | 20,000+ | 5.6.22 | - | 1.0.3 |
| Adobe Fonts (formerly Typekit) for WordPress | 2024-07-17 8:31am GMT | 10,000+ | 6.6.10 | - | 1.10.1 |
| Ultimate Posts Widget | 2024-07-17 1:21am GMT | 10,000+ | 6.6.10 | - | 2.3.2 |
| Login by Auth0 | 2024-07-12 4:57pm GMT | 10,000+ | 6.5.13 | 7.4 | 4.6.2 |
| Create And Assign Categories For Pages | 2024-01-19 6:36pm GMT | 10,000+ | 6.4.13 | - | 1.2.1 |
| 10WebSocial | 2023-02-09 5:06pm GMT | 10,000+ | 5.0.30 | 5.2 | 1.4.35 |
| WP Author, Date and Meta Remover | 2021-01-25 4:06am GMT | 10,000+ | 5.6.22 | - | 1.0.6 |
| Show/Hide Content at Set Time | 2019-10-01 3:45pm GMT | 10,000+ | 5.2.29 | - | 2.5 |
| Cookies for Comments | 2019-06-04 4:47pm GMT | 10,000+ | 5.2.29 | - | 0.5.5 |
| Video User Manuals | 2019-06-02 5:27pm GMT | 10,000+ | 5.1.27 | 5.2.4 | 1.1 |
| TinyMCE Clear Float | 2018-08-01 4:22pm GMT | 10,000+ | 4.9.34 | - | 1.3.2 |
| Dashboard Notepad | 2017-07-30 4:20pm GMT | 10,000+ | 4.1.42 | - | 1.42 |
| WP Missed Schedule Posts | 2017-07-20 10:54am GMT | 10,000+ | 4.8.33 | - | 1.1 |
| WP Help | 2024-04-20 6:45pm GMT | 9,000+ | 6.5.13 | - | 1.7.5 |
| SSL Mixed Content Fix | 2024-07-17 1:21am GMT | 8,000+ | 6.6.10 | - | 3.2.8 |
api.wordpress.org/plugins/info/1.2/ with browse=updated (newest first).active_installs buckets, and record detail fields for sampled plugins with 1,000+ installs.Reproduce locally with npm run measure:plugin-abandonment. Download the latest snapshot: latest.json.
active_installs values are WordPress.org buckets, not exact counts.We followed the measurement idea from WPPoland’s August 2026 plugin abandonment article. Credit to them for publishing a method you can check. The figures on this page are from WP Triage’s own run on 2026-10-07.
This report cannot tell you that. Create an account and connect WordPress installs to get a 0-100 score, a top three, and a fix order that includes unmaintained plugins when they matter on that site. See the agency workflow if you run this as a weekly pass.
No. Last-updated date only tells you about maintenance. A small plugin with no user input can sit untouched for years and stay fine. Risk goes up when an old plugin also takes input, handles payments, has known vulnerabilities, or sits on a PHP or WordPress version that has moved on, and when it is actually installed on a site you run.
We used the public WordPress.org plugins API with browse=updated (newest first), binary-searched for age cutoffs at 1, 2, 3, 5, and 8 years, then sampled every seventh page of the abandoned tail for active-install buckets. The approach follows WPPoland’s published method. The numbers are from our own run.
These directory stats show scale. On a connected site, WP Triage scores unmaintained plugins together with vulnerabilities and PHP lifecycle risk, then returns a 0-100 score, a top three, and a fix order for that install.