WordPress Vulnerability Watch

Monitor WordPress plugins, themes, and core for known vulnerabilities using the public WPVulnerability database.

The Actor is built for recurring security watch workflows:

• checks WordPress.org plugins and themes by slug;
• optionally checks a specific WordPress core version;
• matches known vulnerabilities against the installed version when supplied;
• reports severity, CVSS score, fixed-in version, affected status, and source advisories;
• preserves isolated baselines so repeat runs show new, existing, and resolved findings;
• charges one component-vulnerability-check event per attempted plugin, theme, or core check in pay-per-event mode.

What this Actor does not do

• It does not require WordPress admin credentials.
• It does not scan private files, databases, users, or server configuration.
• It does not prove exploitability on a specific site.
• It is not a guarantee that a site is safe, patched, or compliant.

Use the output as a prioritized public-vulnerability watch, then confirm remediation with vendor guidance, backups, and a staging test.

Input

{
  "plugins": [
    { "slug": "woocommerce", "installedVersion": "10.0.0" },
    { "slug": "wordfence", "installedVersion": "8.1.0" }
  ],
  "themes": [
    { "slug": "flavor", "installedVersion": "1.2.0" }
  ],
  "coreVersion": "6.8.1",
  "minimumSeverity": "medium"
}

If installedVersion is omitted for a plugin or theme, the Actor looks up the current WordPress.org directory version and uses it for affected-version matching.

Output

Dataset rows include:

• component_snapshot — per-component totals, highest severity, and affected finding IDs;
• vulnerability_finding — public advisory evidence, CVSS data, affected status, fixed-in version, and change state;
• component_fetch_error — failed public API lookups;
• summary — requested, processed, findings, new/resolved findings, and spending-limit state.

The key-value store also contains OUTPUT and SUMMARY.

Recurring state

By default, successful complete runs update a named Apify key-value store so the next run can distinguish:

• new — not affected in the previous stored baseline;
• existing — still affected;
• resolved — previously affected but no longer matching the monitored version or public dataset.

Set useStoredState: false for one-off checks.

Data source

Public vulnerability data comes from the WPVulnerability API, which is open and does not require an API key for normal plugin, theme, core, and infrastructure endpoints. The Actor also uses the public WordPress.org directory API when it needs the current plugin or theme version.