What it does
Security lists known vulnerabilities one row per finding — no grouping — matched against your installed plugins, themes and WordPress core from a live CVE feed. Component names are read from the site's own snapshot, the same names the Updates tab uses, never guessed from the advisory title.
There is deliberately no update button here — updating lives on the Updates tab; a finding's How to fix panel links straight there.
How to
- Filter by severity using the chips (critical / high / medium / low·unknown) — they multi-select and the choice is saved in the URL.
- Filter by status: Open, Ignored, Resolved, or All.
- Search by title, slug or CVE, and sort by severity (default), CVSS, newest, or component (keeps related findings adjacent).
- Select rows with the checkboxes for bulk Ignore selected / Unignore selected, or use a row's own actions: How to fix, Ask AI, Ignore.
- The ⋯ menu on a row opens the advisory, copies a reference, or marks it resolved by hand.
- Click Export CSV for exactly what's filtered.
Limits & defaults
| Setting | Default |
|---|---|
| Scan frequency | Fleet-wide rescan daily; the feed itself updates roughly daily and responses are cached 24h |
| Bulk actions | Ignore / Unignore / Ask AI on selected |
| Permissions | Owner, admin and tech can ignore/resolve/Ask AI; viewer is read-only |
Troubleshooting
A component's name looks wrong or generic
Names come from the site's latest snapshot by slug — if a plugin was only just installed, resync the site so its snapshot picks it up.
A finding I ignored keeps reopening
Ignoring is per-finding, not per-component — a new CVE against the same plugin is a new finding and needs its own Ignore.
I fixed it but the finding is still Open
It clears on the next scan once the installed version matches or exceeds "fixed in" — re-run the scan from the finding's How to fix panel to check immediately rather than waiting for the nightly pass.