About this plugin
The EU Cyber Resilience Act (CRA) requires those who develop or manage software — including small agencies that run WordPress sites for clients — to notify known vulnerabilities in the components they use within tight deadlines, if those vulnerabilities are actively exploited. CRA Vuln Notify automates the most time-consuming part of this obligation: knowing a vulnerability exists, understanding how urgent it is, and never missing a deadline. How it works Scans all installed plugins and themes every day (or on demand, with one click from the dashboard), checking their versions against a known vulnerability database. Classifies each vulnerability found by severity — critical, high, medium, low — and checks whether it is actively exploited. Starts the CRA timeline for actively exploited vulnerabilities: preliminary notification within 24 hours of discovery, full notification within 72 hours, final notification upon closure — with countdowns always visible in the dashboard. Alerts you by email and with a banner in wp-admin as soon as a critical vulnerability appears, so you don’t have to check the dashboard every day to notice it. Generates a draft notification document , ready to adapt for submission to the competent authority (national CSIRT / ENISA) or to end users, with a full log exportable to CSV for audit purposes. Vulnerability providers, your choice Works out of the box with WPScan (free, only requires a free API key from the provider), or — if you need more daily requests — with Patchstack (paid). The provider is chosen from Settings, nothing else needs to change. Built for agencies managing multiple sites The dashboard shows at a glance where action is needed and how much time is left to act, instead of discovering a critical vulnerability by chance during a routine check. Important note : this plugin is an operational support tool, not a legal advisory service. The generated documents are drafts to review and adapt: always confirm the applicable regulatory obligations with a qualified legal/compliance advisor before considering yourself compliant. External services This plugin connects to third-party vulnerability databases to check the plugins and themes installed on your site against known vulnerabilities. Only one of the two services below is contacted, depending on which one you select in Settings; both are documented here because either can be chosen. WPScan Vulnerability Database (default, wpscan.com) This service is used to look up known vulnerabilities for a given plugin or theme. For each installed plugin/theme, the plugin sends the component’s slug (its folder/technical name, e.g. “akismet”) to https://wpscan.com/api/v3/plugins/{slug} or https://wpscan.com/api/v3/themes/{slug}, together with the API key you configured in Settings. No installed version number, site URL, user data, or any personally identifiable information is sent — only the component slug. This request happens once per installed component during the daily scheduled scan (WP-Cron) and whenever you click “Scan now” in the dashboard. Terms of Service: https://wpscan.com/terms/ Privacy Policy: https://automattic.com/privacy/ Patchstack Vulnerability Database (optional, paid, patchstack.com) This service is used to look up known vulnerabilities for the plugins and themes installed on your site. The plugin sends, in batches of up to 50 components, each component’s slug, type (plugin/theme), and installed version number to https://patchstack.com/database/api/v2/batch, together with the API key you configured in Settings. No site URL, user data, or any personally identifiable information is sent — only component slugs, types, and version numbers. This request happens during the daily scheduled scan (WP-Cron) and whenever you click “Scan now” in the dashboard, only if Patchstack is selected as the active provider. Terms of Service: https://patchstack.com/terms-and-conditions/ Privacy Policy: https://patchstack.com/privacy-policy/ Like any HTTP request, calls to both services inherit standard connection metadata (e.g. the server’s IP address) as part of the underlying network protocol; the plugin does not add or transmit any additional user-identifying data beyond what is described above.