In reply to Gary.

I am sorry but as long as WordPress allows any theme and any plugin to be activated, a WordPress site can NEVER EVER be secure, I don't care who you are. The core should do a quick "security" check before activating a theme or a plugin - yes, it might take 5-10 seconds longer to activate them, but ensures that the entire site is safe, not just the core.

As a perfect example, there is the "Dbox 3D Slider Lite" - the url is: wordpress.org/plugins/dbox-slider-lite - which contains the timthumb script in it's includes folder... how is this plugin not compromising your site? WordPress should never allow this plugin to get activated - it's that simple. And I am sure there are tons of other examples.

So thanks for "keeping my sites secure"... but they really are not! The core is only one third of the security equation. How about the remaining two thirds - plugins and themes?