Your vulnerability report shows known security issues in the WordPress core, plugins and themes installed on your sites.
Where to find it
Open Dashboard → Vulnerabilities. The site page also shows when the site's vulnerabilities were last checked, with a link to the list.
What each entry shows
- Severity — critical, high, medium or low
- 🔥 Actively exploited — the CVE is in CISA's Known Exploited Vulnerabilities catalog (see Why some vulnerabilities are flagged "fix first")
- CVE ID — the public identifier, e.g. CVE-2024-1234
- Description of the issue
- Fixed in — the version that fixes it, when one exists
- Detected — when PowerSEC found it on your site
You can filter the list by severity.
How quickly to act
A common rule of thumb, based on the severity:
| Severity | Suggested timing |
|---|---|
| Critical | As soon as possible, ideally within a day |
| High | Within a week |
| Medium | In your next maintenance window |
| Low | When convenient |
Actively exploited issues come first, whatever their severity.
What you can do
- Update from Central — on the site page, update the affected plugin (we recommend a fresh backup first). Single updates work on every plan
- Update in WordPress — from Plugins or Dashboard → Updates
- Deactivate the plugin if you don't use it, until a fix is available
- Replace it with an alternative if it is no longer maintained
When there is no fix
Some vulnerabilities are in abandoned plugins with no fixed version. Deactivate or replace the plugin. On Pro plans, PowerSEC may have a virtual-patch firewall rule for some actively exploited issues, but not every vulnerability has one.
How often we check
| What | How often | Plans |
|---|---|---|
| Vulnerability check of your site | About once a day, and when you click Scan on the site page | Every plan |
| Rescans scheduled by Central | When the vulnerability data changes or a site's last check is old | Pro Protection, Pro + Backup Plus, Agency |
PowerSEC rebuilds its vulnerability data every day from public sources, including the U.S. National Vulnerability Database, GitHub's advisory database, and CISA's Known Exploited Vulnerabilities catalog.
A fixed vulnerability still shows
After you update, the entry clears at the next check. To check right away, click Scan on the site page.