Comment by TZubiri

It's crazy how many users are standing by this take. Not only is a 9.8 CVSS critical, even if it doesn't affect your config, you should trash any dependency that has so many 9+CVSS vulns that you become numb to them.

When you use a dependency and a 9+CVSS vuln comes out, you read it and respect it. If you come to the conclusion that CVSS don't mean anything because there's just so many vulns, that's saying something of the dependency and your security posture.

Burn Wordpress with a flemmenwerfer, or build a hard virtualization layer around it, give it its own scoped certs, your Wordpress things will get hacked, especially if they use plugins.