I wonder how many security flaws were in Wordpress core all these years or how many were from plugins with garbage code.