Title: CRA Vuln Notify Author: macroncode Published: September 2, 2026 Last modified: September 2, 2026 --- Search plugins ![](https://ps.w.org/cra-vuln-notify/assets/banner-772x250.png?rev=3678029) ![](https://ps.w.org/cra-vuln-notify/assets/icon-256x256.png?rev=3678029) # CRA Vuln Notify By [macroncode](https://profiles.wordpress.org/macroncode/) [Download](https://downloads.wordpress.org/plugin/cra-vuln-notify.0.1.0.zip) * [Details](https://wordpress.org/plugins/cra-vuln-notify/#description) * [Reviews](https://wordpress.org/plugins/cra-vuln-notify/#reviews) * [Installation](https://wordpress.org/plugins/cra-vuln-notify/#installation) * [Development](https://wordpress.org/plugins/cra-vuln-notify/#developers) [Support](https://wordpress.org/support/plugin/cra-vuln-notify/) ## Description The EU Cyber Resilience Act (CRA) requires those who develop or manage software — including small agencies that run WordPress sites for clients — to notify known vulnerabilities in the components they use within tight deadlines, if those vulnerabilities are actively exploited. **CRA Vuln Notify** automates the most time-consuming part of this obligation: knowing a vulnerability exists, understanding how urgent it is, and never missing a deadline. #### How it works 1. **Scans** all installed plugins and themes every day (or on demand, with one click from the dashboard), checking their versions against a known vulnerability database. 2. **Classifies** each vulnerability found by severity — critical, high, medium, low— and checks whether it is actively exploited. 3. **Starts the CRA timeline** for actively exploited vulnerabilities: preliminary notification within 24 hours of discovery, full notification within 72 hours, final notification upon closure — with countdowns always visible in the dashboard. 4. **Alerts you** by email and with a banner in wp-admin as soon as a critical vulnerability appears, so you don’t have to check the dashboard every day to notice it. 5. **Generates a draft notification document**, ready to adapt for submission to the competent authority (national CSIRT / ENISA) or to end users, with a full log exportable to CSV for audit purposes. #### Vulnerability providers, your choice Works out of the box with **WPScan** (free, only requires a free API key from the provider), or — if you need more daily requests — with **Patchstack** (paid). The provider is chosen from Settings, nothing else needs to change. #### Built for agencies managing multiple sites The dashboard shows at a glance where action is needed and how much time is left to act, instead of discovering a critical vulnerability by chance during a routine check. **Important note**: this plugin is an operational support tool, not a legal advisory service. The generated documents are drafts to review and adapt: always confirm the applicable regulatory obligations with a qualified legal/compliance advisor before considering yourself compliant. ### External services This plugin connects to third-party vulnerability databases to check the plugins and themes installed on your site against known vulnerabilities. Only one of the two services below is contacted, depending on which one you select in Settings; both are documented here because either can be chosen. **WPScan Vulnerability Database** (default, wpscan.com) This service is used to look up known vulnerabilities for a given plugin or theme. For each installed plugin/ theme, the plugin sends the component’s slug (its folder/technical name, e.g. “akismet”) to https://wpscan.com/api/v3/plugins/{slug} or https://wpscan.com/api/v3/themes/{ slug}, together with the API key you configured in Settings. No installed version number, site URL, user data, or any personally identifiable information is sent — only the component slug. This request happens once per installed component during the daily scheduled scan (WP-Cron) and whenever you click “Scan now” in the dashboard. Terms of Service: https://wpscan.com/terms/ Privacy Policy: https://automattic.com/ privacy/ **Patchstack Vulnerability Database** (optional, paid, patchstack.com) This service is used to look up known vulnerabilities for the plugins and themes installed on your site. The plugin sends, in batches of up to 50 components, each component’s slug, type (plugin/theme), and installed version number to https://patchstack.com/ database/api/v2/batch, together with the API key you configured in Settings. No site URL, user data, or any personally identifiable information is sent — only component slugs, types, and version numbers. This request happens during the daily scheduled scan (WP-Cron) and whenever you click “Scan now” in the dashboard, only if Patchstack is selected as the active provider. Terms of Service: https://patchstack.com/terms- and-conditions/ Privacy Policy: https://patchstack.com/privacy-policy/ Like any HTTP request, calls to both services inherit standard connection metadata( e.g. the server’s IP address) as part of the underlying network protocol; the plugin does not add or transmit any additional user-identifying data beyond what is described above. ## Installation 1. Upload the `cra-vuln-notify` folder to `/wp-content/plugins/`. 2. Activate the plugin from the WordPress “Plugins” menu. 3. Go to “CRA Vuln Notify” > “Settings”, choose a vulnerability provider (WPScan or Patchstack) and enter the corresponding API key. 4. The plugin will run an automatic daily scan; you can also trigger a manual scan from the dashboard. ## FAQ ### Which vulnerability database is used? By default the plugin uses the WPScan Vulnerability Database API, which offers a free plan with a quota of 25 requests/day (enough for sites with a small number of plugins/themes; on larger installations a full scan may take more than one day to complete). You can switch to Patchstack instead, a paid provider without this limit. In both cases you need an API key that you register yourself with the chosen provider. ### Does the plugin automatically send notifications to authorities? No. The plugin generates the notification document with the required fields and keeps track of it in the log, but actually sending it to the competent authorities remains a manual action by the user, unless future integrations change this. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CRA Vuln Notify” is open source software. The following people have contributed to this plugin. Contributors * [ macroncode ](https://profiles.wordpress.org/macroncode/) [Translate “CRA Vuln Notify” into your language.](https://translate.wordpress.org/projects/wp-plugins/cra-vuln-notify) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/cra-vuln-notify/), check out the [SVN repository](https://plugins.svn.wordpress.org/cra-vuln-notify/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/cra-vuln-notify/) by [RSS](https://plugins.trac.wordpress.org/log/cra-vuln-notify/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.0 * Initial plugin structure: activation, database table creation, default options. * Installed plugin/theme scanning with a pluggable vulnerability provider (WPScan default, Patchstack paid), daily cron, caching/rate-limiting. * Severity classification (CVSS) and calculation/maintenance of the CRA notification timeline (24h/72h/final) for actively exploited vulnerabilities. * Admin dashboard (Components at risk, Notifications, Settings) with manual “actively exploited” flagging, “Mark resolved” action, admin notice for critical vulnerabilities. * Notification document generation (fillable text draft, downloadable as .txt) and CSV export of the notification log for audit purposes. * Automatic email to the configured address when a new actively exploited vulnerability is detected; full cleanup of tables/options on uninstall. * English as the source language, fully translation-ready (translations to be managed via translate.wordpress.org). ## Meta * Version **0.1.0** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 8.0 or higher ** * Tags * [compliance](https://wordpress.org/plugins/tags/compliance/)[cra](https://wordpress.org/plugins/tags/cra/) [security](https://wordpress.org/plugins/tags/security/)[vulnerability](https://wordpress.org/plugins/tags/vulnerability/) [wordpress security](https://wordpress.org/plugins/tags/wordpress-security/) * [Advanced View](https://wordpress.org/plugins/cra-vuln-notify/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/cra-vuln-notify/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/cra-vuln-notify/reviews/) ## Contributors * [ macroncode ](https://profiles.wordpress.org/macroncode/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/cra-vuln-notify/)