內容簡介
CodeMedic SupplyScope 是一款用於檢測 WordPress 外掛中存在的 Composer 套件漏洞的工具。它每小時掃描活躍的外掛，並在管理控制台中清晰顯示結果，幫助使用者了解隱藏的依賴鏈及其安全風險。
【主要功能】
• 每小時自動掃描活躍外掛的 Composer 依賴
• 顯示漏洞的 CVE 詳細資訊及嚴重性
• 提供修補建議以便採取行動
• 整合多個第三方漏洞資料庫
• 無需傳送個人可識別資訊
外掛標籤
開發者團隊
原文外掛簡介
CodeMedic SupplyScope detects vulnerable Composer packages bundled within your WordPress plugins. Every hour, it scans your active plugins against a continuously updated CVE intelligence feed and displays the results in a clear admin dashboard.
Stop guessing which plugins have unpatched vulnerabilities. Get visibility into the hidden dependency chain of every plugin on your site.
How It Works
Discovery — Every hour, the plugin scans all active WordPress plugins for bundled Composer dependencies and checks them against our cloud CVE API.
Review — Detected vulnerabilities are listed in the admin screen with CVE details, severity, and affected library information.
Act — The plugin reports what’s vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.
Why Dependency Scanning?
WordPress plugins often bundle Composer dependencies (Guzzle, Monolog, PHPUnit, etc.) directly in their vendor directory. Plugin authors may not update these dependencies promptly after a CVE is disclosed. Without a scanner, you have no visibility into these hidden risks.
Patchstack and Wordfence block exploit attempts at the perimeter. This plugin tells you what’s vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.
External Services
This plugin queries several third-party vulnerability databases to detect known CVEs in Composer dependencies bundled by your WordPress plugins. No personally identifiable information is transmitted. Each service is described below.
OSV.dev
What it is: OSV.dev is an open-source vulnerability database maintained by Google. It is used to look up known vulnerabilities in Composer (Packagist) packages.
Data sent: Composer package names and version numbers are sent as JSON in a batch query.
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.
Terms of Service: https://google.github.io/osv.dev/
Privacy Policy: https://policies.google.com/privacy
National Vulnerability Database (NVD)
What it is: The NVD is a public vulnerability database maintained by NIST (U.S. National Institute of Standards and Technology). It is used to search for CVEs related to WordPress plugins by keyword.
Data sent: The WordPress plugin name is sent as a keyword search query parameter. No personal data is transmitted.
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.
Terms of Service: https://nvd.nist.gov/developers/terms-of-use
Privacy Policy: https://www.nist.gov/privacy-policy
Note: This product uses data from the NVD API but is not endorsed or certified by the NVD.
WPVulnerability.net
What it is: WPVulnerability.net is an open-source WordPress vulnerability database. It provides aggregated vulnerability data for WordPress core, plugins, and themes.
Data sent: The WordPress plugin slug is sent as part of the API URL path. No personal data is transmitted.
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.
Terms of Service: https://www.wpvulnerability.com/license/
Privacy Policy: https://www.wpvulnerability.com/privacy/
WordPress.org Plugin API
What it is: The official WordPress.org plugin information API. It is used to retrieve plugin metadata (such as the current stable version and last updated date) to calculate patch velocity metrics.
Data sent: The WordPress plugin slug is sent as a query parameter. No personal data is transmitted.
When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.
Terms of Service: https://wordpress.org/about/privacy/
Privacy Policy: https://wordpress.org/about/privacy/
