外掛標籤
開發者團隊
② 後台搜尋「CoffeeDevs CVE Check for PHP」→ 直接安裝（推薦）
原文外掛簡介
CoffeeDevs CVE Check for PHP shows site administrators whether the PHP version running their server is affected by known vulnerabilities (CVEs) and whether it is still supported.
The check runs under Tools → CVE Check for PHP and compares the installed PHP version with:
the CVE entries of the National Vulnerability Database (NVD) for exactly this PHP version, including severity (CVSS) and the PHP release that fixes each CVE,
the latest release of the same PHP branch (php.net),
the official support dates of the branch (active support, security fixes only, end of life; endoflife.date).
The newest relevant CVE is highlighted, and the result is also shown in Tools → Site Health.
Features
Clear overall status: no known issues, review recommended, or action required.
List of CVEs with severity, publication date and “fixed in” version.
Entries that NVD lists for all PHP versions are shown separately as broad matches and do not influence the result.
Notice for distribution builds (Debian, Ubuntu, …), where fixes are often backported without a version change.
Optional weekly automatic check (opt-in, disabled by default).
Optional NVD API key for higher rate limits.
Translations: English and German (de_DE and de_DE_formal) included.
No tracking, no ads, no frontend output, no credits or links on your website.
Limits
The check is based on the PHP version number only. Linux distributions often fix vulnerabilities without changing the version number, so CVEs may be listed that have already been fixed on your server. For branches that reached end of life, new vulnerabilities are often no longer assessed by NVD. The plugin does not test the server for exploits and does not guarantee that a server is secure.
External services
This plugin connects to the following external services. Requests are only sent when an administrator clicks “Run check now” on the plugin page or has enabled the weekly automatic check. No request is sent on activation, on page views of your website, or by Site Health.
The address of your website, user data and other site information are not transmitted. A neutral user agent (CoffeeDevs-CVE-Check-for-PHP/
php.net – PHP release information
Purpose: latest release of the installed PHP branch and the list of supported branches.
Data sent: the PHP branch (e.g. 8.3).
Endpoint: https://www.php.net/releases/index.php
Terms of use / privacy: https://www.php.net/privacy.php
endoflife.date – support dates
Purpose: release, active support and security support dates of the PHP branches.
Data sent: none beyond the request itself.
Endpoint: https://endoflife.date/api/php.json
Website and terms: https://endoflife.date/ (data licensed under MIT, see https://github.com/endoflife-date/endoflife.date)
National Vulnerability Database (NVD), operated by NIST – CVE data
Purpose: CVEs that affect the installed PHP version.
Data sent: the PHP version (as CPE name, e.g. cpe:2.3:a:php:php:8.3.10:*:*:*:*:*:*:*) and, only if you saved one, your NVD API key.
Endpoint: https://services.nvd.nist.gov/rest/json/cves/2.0
Terms of use: https://nvd.nist.gov/developers/terms-of-use
Privacy policy: https://www.nist.gov/privacy-policy
This product uses the NVD API but is not endorsed or certified by the NVD.
