CodeMedic SupplyScope detects vulnerable Composer packages bundled within your WordPress plugins. Every hour, it scans your active plugins against a continuously updated CVE intelligence feed and displays the results in a clear admin dashboard.<\/p>\n\n
Stop guessing which plugins have unpatched vulnerabilities. Get visibility into the hidden dependency chain of every plugin on your site.<\/p>\n\n
WordPress plugins often bundle Composer dependencies (Guzzle, Monolog, PHPUnit, etc.) directly in their vendor directory. Plugin authors may not update these dependencies promptly after a CVE is disclosed. Without a scanner, you have no visibility into these hidden risks.<\/p>\n\n
Patchstack and Wordfence block exploit attempts at the perimeter. This plugin tells you what's vulnerable so you can take action \u2014 whether that means updating the plugin, replacing it, or applying patches manually.<\/p>\n\n
This plugin queries several third-party vulnerability databases to detect known CVEs in Composer dependencies bundled by your WordPress plugins. No personally identifiable information is transmitted. Each service is described below.<\/p>\n\n
What it is: OSV.dev is an open-source vulnerability database maintained by Google. It is used to look up known vulnerabilities in Composer (Packagist) packages.<\/p>\n\n
Data sent: Composer package names and version numbers are sent as JSON in a batch query.<\/p>\n\n
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.<\/p>\n\n
Terms of Service: https:\/\/google.github.io\/osv.dev\/\nPrivacy Policy: https:\/\/policies.google.com\/privacy<\/p>\n\n
What it is: The NVD is a public vulnerability database maintained by NIST (U.S. National Institute of Standards and Technology). It is used to search for CVEs related to WordPress plugins by keyword.<\/p>\n\n
Data sent: The WordPress plugin name is sent as a keyword search query parameter. No personal data is transmitted.<\/p>\n\n
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.<\/p>\n\n
Terms of Service: https:\/\/nvd.nist.gov\/developers\/terms-of-use\nPrivacy Policy: https:\/\/www.nist.gov\/privacy-policy<\/p>\n\n
Note: This product uses data from the NVD API but is not endorsed or certified by the NVD.<\/p>\n\n
What it is: WPVulnerability.net is an open-source WordPress vulnerability database. It provides aggregated vulnerability data for WordPress core, plugins, and themes.<\/p>\n\n
Data sent: The WordPress plugin slug is sent as part of the API URL path. No personal data is transmitted.<\/p>\n\n
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.<\/p>\n\n
Terms of Service: https:\/\/www.wpvulnerability.com\/license\/\nPrivacy Policy: https:\/\/www.wpvulnerability.com\/privacy\/<\/p>\n\n
What it is: The official WordPress.org plugin information API. It is used to retrieve plugin metadata (such as the current stable version and last updated date) to calculate patch velocity metrics.<\/p>\n\n
Data sent: The WordPress plugin slug is sent as a query parameter. No personal data is transmitted.<\/p>\n\n
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.<\/p>\n\n
Terms of Service: https:\/\/wordpress.org\/about\/privacy\/\nPrivacy Policy: https:\/\/wordpress.org\/about\/privacy\/<\/p>\n\n\n
codemedic-supplyscope<\/code> folder to the \/wp-content\/plugins\/<\/code> directory.<\/li>\n- Activate the plugin through the 'Plugins' menu in WordPress.<\/li>\n
- The plugin begins scanning hourly for vulnerable dependencies. Review findings from Tools > Dep Scanner.<\/li>\n<\/ol>\n\n\n
\nDoes this plugin modify my files?<\/h3><\/dt>\nNo. The free version is read-only \u2014 it scans and reports vulnerabilities but never modifies any files.<\/p><\/dd>\n
How do I fix the vulnerabilities this plugin finds?<\/h3><\/dt>\nUpdate the affected plugin if a newer version is available, replace it with an alternative, or use the patch history to manually apply fixes.<\/p><\/dd>\n
Can I use this alongside other security plugins?<\/h3><\/dt>\nYes. This plugin is complementary to firewalls and WAFs. It focuses on visibility into bundled Composer dependencies that other tools don't inspect.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.0<\/h4>\n\n\n- Initial release.<\/li>\n
- Hourly scanning of active plugins for bundled Composer dependencies.<\/li>\n
- Cloud-based CVE intelligence feed.<\/li>\n
- Read-only vulnerability dashboard with CVE details and severity.<\/li>\n
- Patch history log.<\/li>\n
- Patch history log for audit and manual remediation.<\/li>\n<\/ul>","raw_excerpt":"Scans WordPress plugins for vulnerable Composer dependencies and reports CVEs before they become breaches.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/342906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=342906"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/adrianmikula"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=342906"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=342906"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=342906"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=342906"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=342906"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=342906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}