Black Friday: 50% off. Your first year on any annual plan, until 1 December. See the dealFirst year on annual plans, until 1 December
WPClientHub V2 is live. Fewer plugins on your client sites: caching, forms and image optimization now come built into WPClientHub One. See what’s newCaching, forms and images, built in. See what’s new
WPClientHub
Start free
Sign in Start free

← Docs  /  Sentinel security

Security findings

Sentinel security Updated 2026-09-05

One row per vulnerability — severity, CVSS, filters, bulk ignore, and how findings relate to the Updates tab.

Browse documentation

What it does

Security lists known vulnerabilities one row per finding — no grouping — matched against your installed plugins, themes and WordPress core from a live CVE feed. Component names are read from the site's own snapshot, the same names the Updates tab uses, never guessed from the advisory title.

There is deliberately no update button here — updating lives on the Updates tab; a finding's How to fix panel links straight there.

Known vulnerabilities are one half of the Security tab. The other half — whether the site's files have been tampered with, and what to do about it — is covered in File integrity, protection & response.

How to

  1. Filter by severity using the chips (critical / high / medium / low·unknown) — they multi-select and the choice is saved in the URL.
  2. Filter by status: Open, Ignored, Resolved, or All.
  3. Search by title, slug or CVE, and sort by severity (default), CVSS, newest, or component (keeps related findings adjacent).
  4. Select rows with the checkboxes for bulk Ignore selected / Unignore selected, or use a row's own actions: How to fix, Ask AI, Ignore.
  5. The ⋯ menu on a row opens the advisory, copies a reference, or marks it resolved by hand.
  6. Click Export CSV for exactly what's filtered.

Limits & defaults

SettingDefault
Scan frequencyFleet-wide rescan daily; the feed itself updates roughly daily and responses are cached 24h
Bulk actionsIgnore / Unignore / Ask AI on selected
PermissionsOwner, admin and tech can ignore/resolve/Ask AI; viewer is read-only

Troubleshooting

A component's name looks wrong or generic
Names come from the site's latest snapshot by slug — if a plugin was only just installed, resync the site so its snapshot picks it up.
A finding I ignored keeps reopening
Ignoring is per-finding, not per-component — a new CVE against the same plugin is a new finding and needs its own Ignore.
I fixed it but the finding is still Open
It clears on the next scan once the installed version matches or exceeds "fixed in" — re-run the scan from the finding's How to fix panel to check immediately rather than waiting for the nightly pass.