We don't just list CVEs.
We read the code.
AI-powered source analysis. Billions of crawled pages. A scoring engine that weighs what actually matters. This is WordPress security intelligence that didn't exist before.
What's actually running
in production?
WordPress.org shows "5 million active installs." Cool. But how many of those are running a version with a known SQLi? We process billions of pages from the open web to answer that — with real data, not guesswork.
Real deployments, not download counts.
Sites still running exploitable code.
What stacks sites actually run.
How fast the real web upgrades.
We find the bugs
before the CVE.
Every plugin is parsed at the AST level. We trace user input from $_GET through the code to dangerous sinks like $wpdb->query(). If the data isn't sanitized along the way, we flag it.
Trace user input from $_GET/$_POST through every code path to dangerous sinks. Unsanitized paths flagged automatically.
Dangerous functions, raw SQL ratio, output escaping coverage, nonce checks — the hygiene metrics that predict future CVEs.
Every AJAX handler, REST route, shortcode, and cron callback — inventoried and checked for access controls.
$_POST['plugin_id']$id = $_POST['plugin_id']$query = "SELECT * WHERE id = $id"$wpdb->query( $query )$_GET['search'] → sanitize_text_field() → esc_html()One number. Zero bullshit.
CVSS tells you severity. We tell you risk — by combining vulnerability data, code quality, maintenance history, and real-world exposure into a single 0–100 score.
CVSS scores weighted by recency and patch status. Unpatched criticals hit hardest.
AST-derived metrics — dangerous functions, SQL safety, escaping ratios, nonce coverage.
Update frequency, WP version compatibility, and time-to-patch after CVE disclosure.
Web crawl data: what % of live sites still run vulnerable versions.
Exposed endpoints without proper nonce or capability checks.
Every deduction explained.
Unpatched > patched, always.
5M installs ≠ 500 installs.
Bad code predicts future CVEs.
Version detection that
can't be fooled.
Stripped your readme.txt? Hidden your version headers? Doesn't matter. Our AI models fingerprint every plugin release from CSS/JS asset paths, DOM structures, PHP hook patterns, and directory layouts. We'll still know exactly what you're running.
This is what powers our web crawl version detection at scale — matching fingerprints across hundreds of millions of observed pages.
See it on a real plugin.
Pick anything from the directory. Every plugin gets the full treatment — vulnerabilities, code analysis, real-world exposure, and a transparent score breakdown.