Vulnerabilities in web and app frameworks fall, but weaponization rate jumps – study
portswigger.net
WordPress and Apache Struts take lion’s share of weaponized security bugs

Wordpress, Struts y Laravel los más atacados.