IGW Security History

IGW Security History provides information about the security history of the plugins installed on your WordPress site.

The plugin builds a local inventory of installed plugins and combines this information with known vulnerability data.

For each plugin, it can show:

• Plugin name and installed version.

• Whether the plugin is active or inactive.

• Whether the plugin is available on WordPress.org.

• Whether the plugin appears to be commercial or external.

• Total number of known historical vulnerabilities.

• Vulnerabilities grouped by severity: critical, high, medium, low or unknown.

• Date of the most recently known vulnerability.

• Whether the currently installed version is affected by known vulnerabilities.

This makes it possible to distinguish between a plugin that has had security issues in the past and a plugin whose currently installed version is actually affected by a known vulnerability.

For example, a plugin may have dozens of historical vulnerabilities while its current version has no known vulnerabilities affecting it.

Plugin inventory

IGW Security History maintains a local inventory containing information about the plugins detected on the WordPress installation.

The inventory includes information such as the plugin slug, main file, installed version, activation status, detected source and the dates when the plugin was first and last detected.

This information is stored in custom WordPress database tables.

WordPress.org availability

org plugin directory.

org and plugins detected as commercial or external.

org is reported as unavailable. This does not necessarily mean that the plugin was removed from the directory, since it may be a commercial, private or custom plugin that was never hosted there.

Vulnerability history

IGW Security History retrieves a summarized vulnerability history for detected plugins.

The information includes:

• Total known vulnerabilities.

• Critical vulnerabilities.

• High severity vulnerabilities.

• Medium severity vulnerabilities.

• Low severity vulnerabilities.

• Vulnerabilities without a known severity.

• Most recently published known vulnerability.

Historical vulnerability information does not mean that the currently installed version is vulnerable.

Installed version check

In addition to the historical information, IGW Security History compares the currently installed plugin version against the affected version ranges contained in the vulnerability database.

This allows the plugin to report separately whether known vulnerabilities affect the version currently running on the site.

When no matching vulnerability is found, the plugin reports that there are no known vulnerabilities affecting that version according to the currently available vulnerability data.

Detailed security history

Each detected plugin can be reviewed individually from the IGW Security History administration screen.

The detailed view provides a complete overview of the known vulnerability history for that plugin, including:

• Historical vulnerability totals grouped by severity.

• Security status of the currently installed version.

• A chronological vulnerability timeline.

• Individual vulnerability details, including CVE identifiers when available, severity, CVSS score, publication date and affected version ranges.

• Information about patched versions when available.

The vulnerability timeline provides a visual representation of the plugin’s security history over time. Each point represents a known vulnerability and its position indicates its publication date and severity.

Points can be selected to navigate directly to the corresponding vulnerability information.

When an installed version is being evaluated, the detailed view distinguishes vulnerabilities that affect that specific version from vulnerabilities that only form part of the plugin’s historical record.

Plugins screen integration

Security information is also displayed directly on the standard WordPress Plugins screen.

Depending on the available information, IGW Security History can display:

• WordPress.org availability or detected external/commercial origin.

• Whether the installed version has known vulnerabilities.

• A summary of the plugin’s historical vulnerabilities.

A security history link provides access to the detailed plugin information directly from the Plugins screen.

The detailed security history can be displayed in a modal window without leaving the standard WordPress Plugins screen.

Manual updates

The administration screen provides controls to refresh the plugin inventory and vulnerability information.

Vulnerability checks are performed in batches to reduce the number of external requests.

External services

IGW Security History connects to an external API operated by IguannaWeb in order to retrieve vulnerability information.

The service is required to provide the vulnerability history and installed-version vulnerability checks offered by the plugin.

When a vulnerability update is requested, the plugin sends information about installed plugins to:

com/

The information sent may include:

• Plugin slugs.

• Installed plugin versions.

This information is used to identify known vulnerabilities associated with the installed plugins and to determine whether specific installed versions fall within known affected version ranges.

The plugin does not need to send WordPress user accounts, passwords, post content or other site content to perform these checks.

The vulnerability database used by the IGW API is currently built using vulnerability information from Wordfence Intelligence. WordPress installations using IGW Security History do not connect directly to the Wordfence Intelligence API and do not require a Wordfence Intelligence API key.

The external service is operated by IguannaWeb.

• Service website: https://iguannawp.com/

• Terms and legal information: https://iguannawp.com/politica-de-privacidad/

Because vulnerability information is provided through an external service, availability and results depend on the availability and current data of that service.