According to this wiki article (chapter):


From 2010 there has not been a single vulnerability.

enter image description here

Is this true and Plone is the most secure (among the CMS compared)?

  • That page needs updating. Plone releases CVEs through redhat and it seems that the CVE database does NOT include redhat's CVE database so that number is inaccurate right now.
    – vangheem
    Jul 22, 2013 at 14:01

3 Answers 3


Vulnerability are discovered either by user or by security researched who are looking to make a name for themselves. The co-relation between number of users/vulnerabilities found is only a part of the whole equation. Most vulnerabilities are discovered by security professionals or hackers. For them WordPress is the most lucrative "prize", which can explains the numbers.

What this also means is:

A. Despite the immediate reaction to these statistics, WP is more secure than it looks, because discovered vulnerabilities are often patched.

B. Malicious hackers will not publicize the exploits they use, at least not they had some "fun". For example, the recent Plesk vulnerability was announced in Jun but here in Incapsula we've been blocking such attack from February. (by generic rules) In this respect, Plone might be much less secure than it looks...

C. If you are using a popular CMS, which gets a lot of attention, you should always keep it up-to-date because there a lot of people who`ll use automation to "fish" for for newly discovered vulnerabilities. Good example here is TimThumb. Thought discovered back in 2011, we still see a LOT of TimThum scanners roaming around the net and one can only assume that they keep doing it because they keep discovering new targets.


The only thing you can be sure is that there is no software of this kind without some vulnerabilities. A CMS, even simple, is too complex to be free of any problems, bugs or weak spots.

What you can actually read from the list you have linked is that no vulnerabilities have been reported. This does not mean there aren't any. It can be assumed that the more popular a CMS is, the greater frequency of attacks it suffers. But attacking means discovering security holes, so popularity of a CMS will be correlated with the number of discovered bugs.

  • Thanks for your opinion, but I cannot fully agree with you on the second part of your answer. WordPress is by far the most popular CMS outthere (more than 50% of all CMS used) w3techs.com/technologies/overview/content_management/all and it has only half of the security bugs of Joomla and Drupal. So, I don't think that it correlates.
    – Derfder
    Jul 14, 2013 at 13:05
  • It does not mean there is no correlation, only that there are other factors as well, like the actual number of security holes and the speed with which they are being removed. Joomla, Drupal and Wordpress are similar with respect to the platforms they are run on - it will always be PHP plus, probably, MySQL and Apache. These means attackers of similar skills will try to tackle their security. But discovering a vulnerability in something more popular gives you potential access to more websites, so your efforts can have more impact.
    – user6113
    Jul 14, 2013 at 13:13

Generally: Not being able to see or find something, does not implicate that it does not exist.

As Michael said in his answer, the popularity of course is a great factor. This not only applies to the CMSs themselves, but also to the stack, they are built on. Joomla!, Drupal and Wordpress are by far the most used CMSs on the market, and built on PHP, the by far most used language for web applications, while Plone is used by less than .1% of the sites (according to w3tech), and built on Python.

The next factor is the version of the CMS, for which vulnerabilities are reported. Very often, the issues regard outdated versions, which no longer are supported.

An other factor is the location of the vulnerabilities. Are they located in the core CMS or in extensions? The more extensions a CMS has, the more issues will be counted for the CMS as a whole.

  • Drupal has about 7000 extensions for current versions (7 or 8). Together with extensions for outdated versions, there are 23,000 extensions on the listing.[1]
  • Wordpress states to have about 26,000 extensions[2]. Because of Wordpress' policy, it should be possible to use the extensions with all versions.
  • Joomla! has about 7000 extensions for the current versions (2.5, 3.1)[3]. Numbers for extensions for outdated versions are not available, but it is save to calculate with 15,000 of them.
  • Plone lists about 180 extensions for the current version, plus about 2,000 for older versions[4].

Let's say, there is one security issue per 1000 extensions per year. Then, for current versions, you'd expect this vulnerabilty distribution for the last year:

Drupal        7
Wordpress    26
Joomla!       7
Plone         0

which pretty much matches the last column of the screenshot you posted. The number for Drupal is much higher, though. That might be caused by the fact, that you have to redo everything from scratch for a new version, so also old failures are redone.

Sources: [1] Drupal Modules [2] Wordpress Plugins [3] Joomla Extension Directory [4] Plone Products

  • It's not about extensions! It's about the core. Your explanation is about extensions(plugins/modules etc.), but the graph on the wiki is about vulnerabilities in the core (the basic system) without any additional 3rd party extension. Please, change your answer to reflect this issue if possible, thank you.
    – Derfder
    Jul 14, 2013 at 15:57
  • The CVEs in your screenshot are about both extensions and core. I just verified that for at least Joomla!, where I'm expert enough to differenciate the extensions from the core components.
    – nibra
    Jul 14, 2013 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.