Title: CoffeeDevs CVE Check for PHP
Author: coffeedevs
Published: October 28, 2026
Last modified: October 28, 2026
---
Search plugins
# CoffeeDevs CVE Check for PHP
By [coffeedevs](https://profiles.wordpress.org/coffeedevs/)
[Download](https://downloads.wordpress.org/plugin/coffeedevs-cve-check-for-php.1.0.0.zip)
* [Details](https://wordpress.org/plugins/coffeedevs-cve-check-for-php/#description)
* [Reviews](https://wordpress.org/plugins/coffeedevs-cve-check-for-php/#reviews)
* [Installation](https://wordpress.org/plugins/coffeedevs-cve-check-for-php/#installation)
* [Development](https://wordpress.org/plugins/coffeedevs-cve-check-for-php/#developers)
[Support](https://wordpress.org/support/plugin/coffeedevs-cve-check-for-php/)
## Description
CoffeeDevs CVE Check for PHP shows site administrators whether the PHP version running
their server is affected by known vulnerabilities (CVEs) and whether it is still
supported.
The check runs under **Tools CVE Check for PHP** and compares the installed PHP
version with:
* the **CVE entries of the National Vulnerability Database (NVD)** for exactly
this PHP version, including severity (CVSS) and the PHP release that fixes each
CVE,
* the **latest release of the same PHP branch** (php.net),
* the **official support dates** of the branch (active support, security fixes
only, end of life; endoflife.date).
The newest relevant CVE is highlighted, and the result is also shown in **Tools
Site Health**.
#### Features
* Clear overall status: no known issues, review recommended, or action required.
* List of CVEs with severity, publication date and “fixed in” version.
* Entries that NVD lists for all PHP versions are shown separately as broad matches
and do not influence the result.
* Notice for distribution builds (Debian, Ubuntu, …), where fixes are often backported
without a version change.
* Optional weekly automatic check (opt-in, disabled by default).
* Optional NVD API key for higher rate limits.
* Translations: English and German (de_DE and de_DE_formal) included.
* No tracking, no ads, no frontend output, no credits or links on your website.
#### Limits
The check is based on the PHP version number only. Linux distributions often fix
vulnerabilities without changing the version number, so CVEs may be listed that
have already been fixed on your server. For branches that reached end of life, new
vulnerabilities are often no longer assessed by NVD. The plugin does not test the
server for exploits and does not guarantee that a server is secure.
### External services
This plugin connects to the following external services. **Requests are only sent
when an administrator clicks “Run check now” on the plugin page or has enabled the
weekly automatic check.** No request is sent on activation, on page views of your
website, or by Site Health.
The address of your website, user data and other site information are not transmitted.
A neutral user agent (`CoffeeDevs-CVE-Check-for-PHP/`) is used instead
of the WordPress default, which would contain the site URL. As with every web request,
the services see the IP address of your server.
1. **php.net** – PHP release information
2. * Purpose: latest release of the installed PHP branch and the list of supported
branches.
* Data sent: the PHP branch (e.g. `8.3`).
* Endpoint: `https://www.php.net/releases/index.php`
* Terms of use / privacy: https://www.php.net/privacy.php
3. **endoflife.date** – support dates
4. * Purpose: release, active support and security support dates of the PHP branches.
* Data sent: none beyond the request itself.
* Endpoint: `https://endoflife.date/api/php.json`
* Website and terms: https://endoflife.date/ (data licensed under MIT, see https://
github.com/endoflife-date/endoflife.date)
5. **National Vulnerability Database (NVD), operated by NIST** – CVE data
6. * Purpose: CVEs that affect the installed PHP version.
* Data sent: the PHP version (as CPE name, e.g. `cpe:2.3:a:php:php:8.3.10:*:*:*:*:*:*:*`)
and, only if you saved one, your NVD API key.
* Endpoint: `https://services.nvd.nist.gov/rest/json/cves/2.0`
* Terms of use: https://nvd.nist.gov/developers/terms-of-use
* Privacy policy: https://www.nist.gov/privacy-policy
This product uses the NVD API but is not endorsed or certified by the NVD.
## Installation
1. Upload the plugin folder to `/wp-content/plugins/` or install it via **Plugins
Add New**.
2. Activate the plugin.
3. Open **Tools CVE Check for PHP** and click **Run check now**.
## FAQ
### Why are CVEs listed although my host says PHP is up to date?
Many Linux distributions backport security fixes into older version numbers. The
plugin only knows the version number, so it cannot see backported fixes. The page
shows a notice when PHP reports a distribution build. Ask your host if you are unsure.
### What are “broad matches”?
Some old NVD entries are recorded for all PHP versions, or were published before
your PHP branch existed. They usually do not apply to current PHP versions, so they
are shown separately and do not influence the result.
### Do I need an NVD API key?
No. Without a key, NVD allows only a few requests per minute, which is enough for
occasional checks. With a key, the limit is higher. You can request a free key at
https://nvd.nist.gov/developers/request-an-api-key.
### Who can run the check?
Users with the `manage_options` capability (administrators).
### Does the plugin change anything on my server?
No. It only reads the PHP version and stores the last result and its settings in
the WordPress options table.
### What happens on deactivation and deletion?
Deactivation only stops the weekly automatic check; the last result and the settings
are kept. Deleting the plugin removes all of its data (last result, settings, temporary
data and scheduled events), on multisite for every site.
### Where can I find the source code?
The plugin contains its complete, unminified source code. There is no build step
for PHP or CSS; translations are compiled with `bin/i18n.py` in the development
repository.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“CoffeeDevs CVE Check for PHP” is open source software. The following people have
contributed to this plugin.
Contributors
* [ coffeedevs ](https://profiles.wordpress.org/coffeedevs/)
[Translate “CoffeeDevs CVE Check for PHP” into your language.](https://translate.wordpress.org/projects/wp-plugins/coffeedevs-cve-check-for-php)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/coffeedevs-cve-check-for-php/),
check out the [SVN repository](https://plugins.svn.wordpress.org/coffeedevs-cve-check-for-php/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/coffeedevs-cve-check-for-php/)
by [RSS](https://plugins.trac.wordpress.org/log/coffeedevs-cve-check-for-php/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* Initial release.
## Meta
* Version **1.0.0**
* Last updated **3 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.2 or higher **
* Tags
* [cve](https://wordpress.org/plugins/tags/cve/)[php](https://wordpress.org/plugins/tags/php/)
[security](https://wordpress.org/plugins/tags/security/)[site health](https://wordpress.org/plugins/tags/site-health/)
[vulnerability](https://wordpress.org/plugins/tags/vulnerability/)
* [Advanced View](https://wordpress.org/plugins/coffeedevs-cve-check-for-php/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/coffeedevs-cve-check-for-php/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/coffeedevs-cve-check-for-php/reviews/)
## Contributors
* [ coffeedevs ](https://profiles.wordpress.org/coffeedevs/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/coffeedevs-cve-check-for-php/)