Right now the exposed sites are the ones someone updates by hand, whenever they remember.
RS Web Solutions reports that WordPress 7.1.4 fixes a remote code execution flaw and cross-site scripting, and two independent sources carried it. The site you think about is the easy one to patch: the risk sits in the one you inherited, or the public staging copy, or the install nobody has opened since the last redesign... So the real job is an inventory: which of your sites actually update themselves, and which only claim to.
If any of them take payments or hold accounts, I will go through that flow and the update path with you. A small audit takes days, not months, and you get cost and timeline within a day.
Message me with how many sites you run and I will tell you where to start.