CodeMedic SupplyScope

CodeMedic SupplyScope detects vulnerable Composer packages bundled within your WordPress plugins. Every hour, it scans your active plugins against a continuously updated CVE intelligence feed and displays the results in a clear admin dashboard.

Stop guessing which plugins have unpatched vulnerabilities. Get visibility into the hidden dependency chain of every plugin on your site.

How It Works

1. Discovery — Every hour, the plugin scans all active WordPress plugins for bundled Composer dependencies and checks them against our cloud CVE API.
2. Review — Detected vulnerabilities are listed in the admin screen with CVE details, severity, and affected library information.
3. Act — The plugin reports what’s vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

Why Dependency Scanning?

WordPress plugins often bundle Composer dependencies (Guzzle, Monolog, PHPUnit, etc.) directly in their vendor directory. Plugin authors may not update these dependencies promptly after a CVE is disclosed. Without a scanner, you have no visibility into these hidden risks.

Patchstack and Wordfence block exploit attempts at the perimeter. This plugin tells you what’s vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

External Services

This plugin queries several third-party vulnerability databases to detect known CVEs in Composer dependencies bundled by your WordPress plugins. No personally identifiable information is transmitted. Each service is described below.

OSV.dev

What it is: OSV.dev is an open-source vulnerability database maintained by Google. It is used to look up known vulnerabilities in Composer (Packagist) packages.

Data sent: Composer package names and version numbers are sent as JSON in a batch query.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://google.github.io/osv.dev/ Privacy Policy: https://policies.google.com/privacy

National Vulnerability Database (NVD)

What it is: The NVD is a public vulnerability database maintained by NIST (U.S. National Institute of Standards and Technology). It is used to search for CVEs related to WordPress plugins by keyword.

Data sent: The WordPress plugin name is sent as a keyword search query parameter. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://nvd.nist.gov/developers/terms-of-use Privacy Policy: https://www.nist.gov/privacy-policy

Note: This product uses data from the NVD API but is not endorsed or certified by the NVD.

WPVulnerability.net

What it is: WPVulnerability.net is an open-source WordPress vulnerability database. It provides aggregated vulnerability data for WordPress core, plugins, and themes.

Data sent: The WordPress plugin slug is sent as part of the API URL path. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://www.wpvulnerability.com/license/ Privacy Policy: https://www.wpvulnerability.com/privacy/

WordPress.org Plugin API

What it is: The official WordPress.org plugin information API. It is used to retrieve plugin metadata (such as the current stable version and last updated date) to calculate patch velocity metrics.

Data sent: The WordPress plugin slug is sent as a query parameter. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://wordpress.org/about/privacy/ Privacy Policy: https://wordpress.org/about/privacy/