{"id":320191,"date":"2026-06-15T03:55:18","date_gmt":"2026-06-15T03:55:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/vuln-guard-security-vulnerability-scanner\/"},"modified":"2026-06-15T04:33:17","modified_gmt":"2026-06-15T04:33:17","slug":"pura-vida-vulnerability-scanner","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/pura-vida-vulnerability-scanner\/","author":23508516,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.9","stable_tag":"1.0.9","tested":"7.0","requires":"5.6","requires_php":"7.2","requires_plugins":null,"header_name":"Pura Vida Vulnerability Scanner","header_author":"Pura Vida Design Studio","header_description":"Scans your installed plugins, themes and WordPress core against trusted vulnerability databases (Wordfence Intelligence) and gives you actionable, prioritized security recommendations.","assets_banners_color":"425d55","last_updated":"2026-06-15 04:33:17","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/puravidadesignstudio.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":31,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.9":{"tag":"1.0.9","author":"trgomez","date":"2026-06-15 04:33:17"}},"upgrade_notice":{"1.0.1":"<p>Fixes the security overview table styling and avoids the feed rate limit on repeated scans.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3572395,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3572395,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3572401,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3572401,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.9"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[31093,1184,6464,600,6460],"plugin_category":[54],"plugin_contributors":[267159],"plugin_business_model":[],"class_list":["post-320191","plugin","type-plugin","status-publish","hentry","plugin_tags-hardening","plugin_tags-malware","plugin_tags-scanner","plugin_tags-security","plugin_tags-vulnerability","plugin_category-security-and-spam-protection","plugin_contributors-trgomez","plugin_committers-trgomez"],"banners":{"banner":"https:\/\/ps.w.org\/pura-vida-vulnerability-scanner\/assets\/banner-772x250.png?rev=3572401","banner_2x":"https:\/\/ps.w.org\/pura-vida-vulnerability-scanner\/assets\/banner-1544x500.png?rev=3572401","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/pura-vida-vulnerability-scanner\/assets\/icon-128x128.png?rev=3572395","icon_2x":"https:\/\/ps.w.org\/pura-vida-vulnerability-scanner\/assets\/icon-256x256.png?rev=3572395","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Pura Vida Vulnerability Scanner checks everything installed on your site, including plugins, themes and WordPress core, against the <strong>Wordfence Intelligence<\/strong> vulnerability database, audits your site's security posture, and shows you exactly what is at risk and how to fix it.<\/p>\n\n<p>It does not invent findings. It correlates your installed software and configuration against authoritative public sources (Wordfence Intelligence, CVE\/MITRE, the WordPress.org update channel) and live checks of your own server.<\/p>\n\n<p><strong>Security overview<\/strong><\/p>\n\n<p>The dashboard opens with an at-a-glance status table covering:<\/p>\n\n<ul>\n<li>WordPress Version: OK \/ Warning<\/li>\n<li>Vulnerable Plugins: OK \/ Critical \/ High \/ Medium<\/li>\n<li>Missing Headers: Present \/ Missing \/ N\/A (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)<\/li>\n<li>SSL: Valid \/ Expiring soon \/ Expired \/ N\/A (certificate expiry)<\/li>\n<li>DNS: OK \/ Issues \/ N\/A<\/li>\n<li>Email Security: SPF and DMARC (DKIM is selector-specific)<\/li>\n<li>CDN\/WAF: Detected \/ Not detected \/ N\/A<\/li>\n<\/ul>\n\n<p><strong>What it does<\/strong><\/p>\n\n<ul>\n<li>Inventories every installed plugin, theme and the WordPress core version.<\/li>\n<li>Matches each item and version against a continuously updated vulnerability feed.<\/li>\n<li>Shows severity (CVSS), the CVE identifier, a description and the recommended fix for every finding.<\/li>\n<li>Audits your configuration and lists prioritized hardening recommendations (2FA, updates, HTTPS, file editor, and more).<\/li>\n<li>Optional scheduled scans with email alerts when new critical\/high issues appear.<\/li>\n<\/ul>\n\n<p><strong>Data sources<\/strong><\/p>\n\n<ul>\n<li>Wordfence Intelligence Vulnerability Data Feed: free for personal and commercial use; includes CVE (MITRE) and CVSS information.<\/li>\n<li>CVE (MITRE Corporation): the canonical vulnerability identifiers.<\/li>\n<li>WordPress.org update channel: available core, plugin and theme updates.<\/li>\n<li>Live site checks performed by the plugin: HTTP headers, SSL, DNS, SPF\/DMARC and CDN\/WAF.<\/li>\n<\/ul>\n\n<p>This product includes data that may be copyrighted by Defiant Inc. (Wordfence Intelligence) and by the MITRE Corporation (CVE\u00ae); their notices are displayed alongside the relevant findings.<\/p>\n\n<p>Developed by Pura Vida Design Studio, Open Source Security &amp; Website Tools (https:\/\/puravidadesignstudio.com\/).<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to one external service to function: the Wordfence Intelligence Vulnerability Data Feed.<\/p>\n\n<p><strong>Wordfence Intelligence Vulnerability Data Feed (Defiant Inc.)<\/strong>\nThis plugin downloads the public WordPress vulnerability database from Wordfence in order to match it against the plugins, themes and core version installed on your site.<\/p>\n\n<ul>\n<li>What is sent: your Wordfence Intelligence API key (in the request Authorization header) and your site's URL (in the request User-Agent header), sent to https:\/\/www.wordfence.com\/. The list of plugins and themes installed on your site is NOT transmitted; matching is performed locally on your own server.<\/li>\n<li>When it is sent: when you run a manual scan, and when a scheduled scan runs (about once per day). The downloaded database is cached locally for 24 hours so the service is contacted at most about once per day.<\/li>\n<li>Service terms: https:\/\/www.wordfence.com\/wordfence-intelligence-terms-and-conditions\/<\/li>\n<li>Privacy policy: https:\/\/www.wordfence.com\/privacy-policy\/<\/li>\n<\/ul>\n\n<p>The plugin also performs read-only checks against your own site for the Security Overview: a loopback HTTP request to your own home URL (to inspect response headers and detect a CDN\/WAF) and DNS lookups for your own domain (to check DNS resolution and SPF\/DMARC records). These query your own domain and public DNS only; no data is sent to any third party.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>pura-vida-vulnerability-scanner<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install the ZIP via <strong>Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Go to <strong>Pura Vida Vulnerability Scanner \u2192 Settings<\/strong> and paste a free Wordfence Intelligence API key (create one at your Wordfence account \u2192 Integrations).<\/li>\n<li>Open <strong>Pura Vida Vulnerability Scanner<\/strong> and click <strong>Scan now<\/strong>.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20paid%20account%20anywhere%3F\"><h3>Do I need a paid account anywhere?<\/h3><\/dt>\n<dd><p>No. The Wordfence Intelligence feed is free for personal and commercial use. You only need to generate a free API key.<\/p><\/dd>\n<dt id=\"why%20do%20some%20rows%20show%20n%2Fa%3F\"><h3>Why do some rows show N\/A?<\/h3><\/dt>\n<dd><p>Your host may block loopback HTTP requests or disable PHP's DNS\/OpenSSL functions. Those checks are skipped safely while everything else still works.<\/p><\/dd>\n<dt id=\"why%20isn%27t%20dkim%20checked%20automatically%3F\"><h3>Why isn't DKIM checked automatically?<\/h3><\/dt>\n<dd><p>DKIM records live at a selector-specific hostname that varies per mail provider and can't be reliably guessed. Pura Vida Vulnerability Scanner checks SPF and DMARC, which are deterministic.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20send%20my%20site%20data%20anywhere%3F\"><h3>Does the plugin send my site data anywhere?<\/h3><\/dt>\n<dd><p>It downloads the public vulnerability feed and matches it locally on your server. Your list of installed plugins is not transmitted.<\/p><\/dd>\n<dt id=\"how%20often%20is%20the%20data%20updated%3F\"><h3>How often is the data updated?<\/h3><\/dt>\n<dd><p>The feed is cached locally and refreshed on your chosen schedule (daily by default), so scans are fast and stay within the provider's rate limits.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.9<\/h4>\n\n<ul>\n<li>Removed Plugin URI so it no longer duplicates the Author URI.<\/li>\n<\/ul>\n\n<h4>1.0.8<\/h4>\n\n<ul>\n<li>Renamed plugin to Pura Vida Vulnerability Scanner; updated slug\/text domain, Plugin URI and contributors per WordPress.org pre-review.<\/li>\n<\/ul>\n\n<h4>1.0.7<\/h4>\n\n<ul>\n<li>Set Tested up to 7.0 (the current WordPress release).<\/li>\n<\/ul>\n\n<h4>1.0.6<\/h4>\n\n<ul>\n<li>Set Tested up to 6.8 (a current, released WordPress version).<\/li>\n<\/ul>\n\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Fixed: set the Tested up to header to a version the Plugin Check recognizes as released.<\/li>\n<\/ul>\n\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Fixed: resolved all Plugin Check findings (Tested up to header, Domain Path, prefixed view variables, removed discouraged functions, justified socket\/close and per-field sanitization).<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Added: External services disclosure (required for WordPress.org listing).<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Fixed: status overview table header labels now align with their columns.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Fixed: status overview table now renders with full styling (asset cache busting).<\/li>\n<li>Improved: manual scans re-use the cached vulnerability database, so repeated scans no longer hit the provider's daily download limit.<\/li>\n<li>Improved: clearer messaging about the once-per-day database caching behavior.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: vulnerability scanning for plugins, themes and core; security overview table; configuration recommendations; scheduled scans and email alerts.<\/li>\n<\/ul>","raw_excerpt":"Scan your plugins, themes and WordPress core against trusted vulnerability databases and get a clear, prioritized security overview.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/320191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=320191"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/trgomez"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=320191"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=320191"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=320191"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=320191"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=320191"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=320191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}